Go-Based Malware Deploys XMRig Miner on Linux Hosts via Redis Configuration Abuse

Cybersecurity experts have identified a new Linux cryptojacking campaign called RedisRaider, which targets publicly accessible Redis servers to deploy cryptocurrency miners. This threat impacts Linux server infrastructures and Redis instances globally. #Redis #LinuxServers

Keypoints

The RedisRaider campaign exploits Redis’s legitimate commands to inject malicious cron jobs on vulnerable Linux servers.
The malware drops a custom XMRig miner and propagates itself across Redis instances by exploiting misconfigured servers.
The attack uses stealthy anti-forensics techniques, such as short TTL settings and configuration changes, to avoid detection.
RedisRaider also hosts a web-based Monero miner, enabling multiple revenue streams for the attackers.
The campaign’s sophisticated approach highlights the importance of securing Redis servers and monitoring for unauthorized activity.

Tags: PAYLOAD, EMAIL, PASSWORD, LINUX, SMTP, CREDENTIAL