Kiran 
A cryptomining operation that quietly hijacked thousands of Redis servers was unmasked not by external detection, but by its own carelessness: an open directory on the operator’s rented server exposed the full campaign toolkit, logs, and infrastructure.
Researchers at Hunt.io found an open directory on port 80 at 188.245[.]99.156, containing 147 files: Python exploit scripts, JSON campaign logs, a portable Python 3.11 runtime, and two exported Windows registry hives.
Unlike typical cryptomining drops that hold only a payload, this directory was the operator’s entire working environment: production code alongside abandoned test scripts and raw telemetry never meant to be seen.
Redis Cryptomining Botnet Hits 3,562 Servers
The directory was first indexed on June 21, 2026, and last confirmed live on June 27.
Parsing the operator’s own logs revealed 3,562 distinct Redis servers compromised across two campaign runs against a shared list of 12,966 targets, with a 22–26% hit rate.
The technique responsible is rogue replication abuse: attackers issue SLAVEOF to force a victim Redis instance into syncing from a rogue master, then smuggle a crafted RDB blob containing a cron entry onto disk.
No authentication bypass or memory-corruption bug is needed, just an internet-exposed Redis instance with no password set.
Confirmed victims ran Redis versions from 2.8.17 (2015) through 7.2.0 (2023), proving this is purely a configuration failure rather than a patchable bug.
A third run against a pre-qualified, freshly verified no-auth fleet hit 72.6%, roughly triple the rate against the stale full list, showing target-list freshness, not the exploit itself, was the real limiting factor.
The toolkit contained four attack paths, but only Redis replication worked at scale. SSH key-injection via Redis’s append-only file mode and a MongoDB JavaScript sandbox-escape probe returned zero successes across 2,810 attempts, mostly blocked by authentication.
A parallel WordPress credential-spray and webshell-staging chain was fully built, but recovered files couldn’t confirm its real-world scale.
Every compromised host was pointed at a hardcoded Monero wallet mining through pool.moneroocean[.]stream. That same wallet also surfaced in a separate February 2026 open directory in Moldova containing a Meterpreter and XMRig kit, pushing the operator’s known activity back at least five months.
Notably, the operator ran local cryptomining on their own Windows workstation using the identical wallet, directly tying the botnet’s proceeds to their own machine.
“What makes this case remarkable isn’t the exploitation technique SLAVEOF-based RDB abuse has circulated in public research for years; it’s the operator’s operational sloppiness.
Leaving campaign telemetry, registry hives, and a reused wallet address in an open directory turned a routine botnet into a full tradecraft case study. It’s a reminder that attacker OPSEC failures can be just as valuable to defenders as victim-side detection.”
Mitigation
Security teams should treat any internet-facing Redis instance without requirepass as compromised until proven otherwise, audit cron directories for suspicious entries referencing curl, tar, or xmrig, and disable SLAVEOF/REPLICAOF via rename-command where replication isn’t used. Since vulnerable versions span nearly a decade, only configuration not upgrading closes this gap.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
