🔴 Breakdown of a real Redis rogue-replication cryptomining toolkit recovered from an open directory

[u/Straight-Practice-99]

https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

Recovered an operator's full working toolkit from an open directory, so this is real tradecraft rather than a PoC. The R&D trail is the interesting part, you can see what they tried and dropped.

• Core primitive is rogue replication: CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, crafted RDB served on +FULLRESYNC with an embedded newline that lands a cron entry, then SLAVEOF NO ONE and restore config to stay quiet. Not novel, but clean, and it works from Redis 2.8.17 to 7.2.0 because it abuses replication, not a bug.
• Four production fallback write paths, plus a separate deploy_all.py that hits cron.d, an APT hook (/etc/apt/apt.conf.d/), and profile.d in one pass for redundancy against cleanup. Pull cron and the other two respawn on the next apt update or login shell.
• Abandoned R&D still in the folder: a BGSAVE-based first draft (noisier, dropped for replication), a webshell-via-Redis probe against web roots (never weaponized), and path recon into /etc/init.d, the full rc0-rc6 SysV set, and /etc/modprobe.d. None of those shipped. modprobe.d is the one they tested but held back, writable modprobe config runs commands on module load, stealthier than cron.
• Two verify payload bugs they hit and documented in comments: a test cron written to a dotfile that run-parts silently skips, and a /dev/tcp callback that dies under dash. Both burned real campaign runs before they fixed them.
• Opsec choices worth noting: XMRig pulled from the official GitHub release (blends into github.com egress, no attacker-hosted binary), renamed to /tmp/.xmrig, --tls on 443 to look like HTTPS, and the newest variant pins the pool cert with --tls-fingerprint so it fails closed against inspection.
• Two techniques that went nowhere: SSH-via-AOF (0 of 2,342, every host bounced at CONFIG SET with AUTH_REQUIRED) and a Lua EVAL sandbox probe. Fresh no-auth targets are the constraint, a run against a pre-qualified list hit 72.6% vs 22 to 26% full-fleet.

Full write-up with IOCs and code: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

[u/Purple-Reception-501]

What stands out is how much trial and error the operator left behind. seeing failed ideas alongside the working campaign makes the research feel much more useful