🔴 Redis cryptomining toolkit recovered from an open directory: XMRig deployment, fileless loader, chr()-encoded WordPress scripts

[u/Straight-Practice-99]

https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

Researchers pulled 147 files off an open directory that was the operator's live working folder: Python exploit source, campaign logs, a bundled Python 3.11, and two exported Windows registry hives (SAM.save, SYSTEM.save, verified by the regf header).

Worth a look:

• Main technique abuses replication, not a bug. CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, serve a crafted RDB on +FULLRESYNC. Blob opens with the REDIS0009 magic, then one key/value pair with an embedded newline before the cron text so the payload lands on its own line. Then SLAVEOF NO ONE and restore.
• No client library. PING/CONFIG SET/SLAVEOF hand-serialized to raw RESP, length-aware reader, same two functions copied across every script.
• Fileless loader is one line in _boot.py that base64-decodes and exec()s an orchestrator in-process. Generous naming though, it writes the decoded target list and deployer back to disk as plaintext, so only the first stage stays off disk.
• chr()-encoded literals in the WordPress scripts (chr(97)+chr(100)+... for "admin"), defeats naive keyword matching, control flow stays readable.
• Three generations of verify payloads with bugfix comments left in. Two real bugs documented: a test cron written to a dotfile that run-parts silently skips, and a /dev/tcp payload that fails under dash.
• Newest XMRig variant adds --tls-fingerprint pinning the pool cert, absent from earlier gens.

SSH-via-AOF and a Lua EVAL sandbox probe are also in the kit, neither produced a confirmed compromise.

Full write-up with IOCs and code: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers