Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

    Date: 09/09/2026

    Severity: Medium

    Summary

    Analysis of the operator’s campaign logs identified 3,562 compromised Redis servers across two runs, with 22–26% of targets breached and most remaining hosts blocked by authentication. Victims ranged from Redis 2.8.17 to 7.2.0 and included systems running outdated RHEL/CentOS 6 through current Ubuntu kernels, indicating missing authentication not a version-specific flaw as the primary weakness. A third run against a pre-qualified no-auth fleet achieved a 72.6% compromise rate, while Redis rogue replication was the only toolkit technique to work at scale; SSH key injection and MongoDB sandbox escapes returned zero results. The shared Monero wallet links the botnet’s cryptomining payloads to the operator’s own workstation, while a February 2026 Meterpreter/XMRig kit using the same wallet extends the activity’s known history by at least five months.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    pool.moneroocean.stream

    socket.ayakliborsa.net

    IP Address 

    188.245.99.156

    45.155.102.89

    47.250.92.230

    34.166.99.116

    20.198.10.42

    213.6.207.123

    173.212.244.25

    23.235.223.49

    194.48.248.105

    File Path

    /etc/cron.d/redis-miner

    /etc/cron.hourly/redis-miner

    /etc/cron.d/redis-update

    /var/spool/cron/root

    /var/spool/cron/crontabs/root

    /root/.ssh/authorized_keys

    /home/redis/.ssh/authorized_keys

    /var/lib/redis/.ssh/authorized_keys

    /etc/apt/apt.conf.d/99sys-update

    /etc/profile.d/sys-init.sh

    /tmp/.xmrig, /tmp/.xr

    TLS fingerprint 

    420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a 

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "socket.ayakliborsa.net" or url like "socket.ayakliborsa.net" or siteurl like "socket.ayakliborsa.net" or domainname like "pool.moneroocean.stream" or url like "pool.moneroocean.stream" or siteurl like "pool.moneroocean.stream"

    Detection Query 2 :

    dstipaddress IN ("194.48.248.105","47.250.92.230","34.166.99.116","173.212.244.25","188.245.99.156","45.155.102.89","20.198.10.42","213.6.207.123","23.235.223.49") or srcipaddress IN ("194.48.248.105","47.250.92.230","34.166.99.116","173.212.244.25","188.245.99.156","45.155.102.89","20.198.10.42","213.6.207.123","23.235.223.49")

    Detection Query 3 :

    datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "/etc/cron.d/redis-miner" or objectname like "/etc/cron.hourly/redis-miner" or objectname like "/etc/cron.d/redis-update" or objectname like "/var/spool/cron/root" or objectname like "/var/spool/cron/crontabs/root" or objectname like "/root/.ssh/authorized_keys" or objectname like "/home/redis/.ssh/authorized_keys" or objectname like "/var/lib/redis/.ssh/authorized_keys" or objectname like "/etc/apt/apt.conf.d/99sys-update" or objectname like "/etc/profile.d/sys-init.sh" or objectname like "/tmp/.xmrig" or objectname like "/tmp/.xr")

    Detection Query 4 :

    technologygroup = "EDR" and (objectname like "/etc/cron.d/redis-miner" or objectname like "/etc/cron.hourly/redis-miner" or objectname like "/etc/cron.d/redis-update" or objectname like "/var/spool/cron/root" or objectname like "/var/spool/cron/crontabs/root" or objectname like "/root/.ssh/authorized_keys" or objectname like "/home/redis/.ssh/authorized_keys" or objectname like "/var/lib/redis/.ssh/authorized_keys" or objectname like "/etc/apt/apt.conf.d/99sys-update" or objectname like "/etc/profile.d/sys-init.sh" or objectname like "/tmp/.xmrig" or objectname like "/tmp/.xr")

    Reference:    

    https://hunt.io/blog/redis-cryptomining-botnet-3562-servers                                     


    Tags

    MalwareCryptominingBotnetMoneroMeterpreter

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags