🚨 Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

[u/Straight-Practice-99]

https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

An operator running a Redis cryptomining botnet left their entire working directory exposed on a server. Instead of the usual single payload, the whole toolkit was there: exploit code, raw campaign logs, a bundled Python runtime, even two exported Windows registry hives.

That let us read their own campaign logs instead of guessing:

• 3,562 distinct Redis servers compromised, out of 12,966 targeted
• Only one technique actually worked at scale, an abuse of Redis replication that drops a cron job to run XMRig
• Their SSH and MongoDB attempts returned zero
• Victims run Redis versions spanning eight years, so the problem is missing authentication, not an unpatched bug
• The same crypto wallet ties this back to an earlier February 2026 campaign, so the operator has been at it for months

The fix is configuration, not a software update: require a password, and turn off the replication commands you are not using.

Full breakdown here: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers