Date: 09/09/2026
Severity: Medium
Summary
Analysis of the operator’s campaign logs identified 3,562 compromised Redis servers across two runs, with 22–26% of targets breached and most remaining hosts blocked by authentication. Victims ranged from Redis 2.8.17 to 7.2.0 and included systems running outdated RHEL/CentOS 6 through current Ubuntu kernels, indicating missing authentication not a version-specific flaw as the primary weakness. A third run against a pre-qualified no-auth fleet achieved a 72.6% compromise rate, while Redis rogue replication was the only toolkit technique to work at scale; SSH key injection and MongoDB sandbox escapes returned zero results. The shared Monero wallet links the botnet’s cryptomining payloads to the operator’s own workstation, while a February 2026 Meterpreter/XMRig kit using the same wallet extends the activity’s known history by at least five months.
Indicators of Compromise (IOC) List
Domains/URLs | pool.moneroocean.stream socket.ayakliborsa.net |
IP Address | 188.245.99.156 45.155.102.89 47.250.92.230 34.166.99.116 20.198.10.42 213.6.207.123 173.212.244.25 23.235.223.49 194.48.248.105 |
File Path | /etc/cron.d/redis-miner /etc/cron.hourly/redis-miner /etc/cron.d/redis-update /var/spool/cron/root /var/spool/cron/crontabs/root /root/.ssh/authorized_keys /home/redis/.ssh/authorized_keys /var/lib/redis/.ssh/authorized_keys /etc/apt/apt.conf.d/99sys-update /etc/profile.d/sys-init.sh /tmp/.xmrig, /tmp/.xr |
TLS fingerprint | 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "socket.ayakliborsa.net" or url like "socket.ayakliborsa.net" or siteurl like "socket.ayakliborsa.net" or domainname like "pool.moneroocean.stream" or url like "pool.moneroocean.stream" or siteurl like "pool.moneroocean.stream" |
Detection Query 2 : | dstipaddress IN ("194.48.248.105","47.250.92.230","34.166.99.116","173.212.244.25","188.245.99.156","45.155.102.89","20.198.10.42","213.6.207.123","23.235.223.49") or srcipaddress IN ("194.48.248.105","47.250.92.230","34.166.99.116","173.212.244.25","188.245.99.156","45.155.102.89","20.198.10.42","213.6.207.123","23.235.223.49") |
Detection Query 3 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "/etc/cron.d/redis-miner" or objectname like "/etc/cron.hourly/redis-miner" or objectname like "/etc/cron.d/redis-update" or objectname like "/var/spool/cron/root" or objectname like "/var/spool/cron/crontabs/root" or objectname like "/root/.ssh/authorized_keys" or objectname like "/home/redis/.ssh/authorized_keys" or objectname like "/var/lib/redis/.ssh/authorized_keys" or objectname like "/etc/apt/apt.conf.d/99sys-update" or objectname like "/etc/profile.d/sys-init.sh" or objectname like "/tmp/.xmrig" or objectname like "/tmp/.xr") |
Detection Query 4 : | technologygroup = "EDR" and (objectname like "/etc/cron.d/redis-miner" or objectname like "/etc/cron.hourly/redis-miner" or objectname like "/etc/cron.d/redis-update" or objectname like "/var/spool/cron/root" or objectname like "/var/spool/cron/crontabs/root" or objectname like "/root/.ssh/authorized_keys" or objectname like "/home/redis/.ssh/authorized_keys" or objectname like "/var/lib/redis/.ssh/authorized_keys" or objectname like "/etc/apt/apt.conf.d/99sys-update" or objectname like "/etc/profile.d/sys-init.sh" or objectname like "/tmp/.xmrig" or objectname like "/tmp/.xr") |
Reference:
https://hunt.io/blog/redis-cryptomining-botnet-3562-servers