3,500 Unsecured Redis Servers Fall Prey to Cryptojacking Operation

A recent cryptocurrency mining operation has compromised over 3,500 unsecured Redis servers worldwide. The campaign, discovered by researchers at Hunters.io, exploited a misconfiguration in the database servers' internet-facing configuration rather than a software bug.

The attackers used a legitimate feature of Redis's master-replica replication system to deliver a cron task that pulled down a copy of XMRig, an open-source Monero mining software. The miner then connected to a mining pool over port 443, hiding its network activity inside typical outbound connections.

The campaign mirrors earlier waves of Redis cryptojacking activity and P2PInfect campaigns, which also relied on the same basic weakness: unauthenticated database servers sitting open to the internet.