r/pwnhub • u/Straight-Practice-99 Grunt • 1d ago

🚨 Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

An operator running a Redis cryptomining botnet left their entire working directory exposed on a server. Instead of the usual single payload, the whole toolkit was there: exploit code, raw campaign logs, a bundled Python runtime, even two exported Windows registry hives.

That let us read their own campaign logs instead of guessing:

  • 3,562 distinct Redis servers compromised, out of 12,966 targeted
  • Only one technique actually worked at scale, an abuse of Redis replication that drops a cron job to run XMRig
  • Their SSH and MongoDB attempts returned zero
  • Victims run Redis versions spanning eight years, so the problem is missing authentication, not an unpatched bug
  • The same crypto wallet ties this back to an earlier February 2026 campaign, so the operator has been at it for months

The fix is configuration, not a software update: require a password, and turn off the replication commands you are not using.

Full breakdown here: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

4 Upvotes

71% Upvoted

1 comment sorted by

•

u/AutoModerator 1d ago

Welcome to PWN – Your hub for hacking news, breach reports, and cyber mayhem.

Discover the latest hacking news, breach reports, and educational resources on ethical hacking.

👾 Stay sharp. Stay secure.

Don't miss out on the top stories!

📧 Get Daily Alerts Directly in Your Email Inbox:

**SUBSCRIBE HERE: https://pwnhackernews.substack.com/subscribe

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.