Hackers Turn 3,562 Redis Servers Into Crypto Miners
A cryptomining operation has compromised 3,562 Redis database servers and turned their processing power into Monero revenue — without exploiting a single software vulnerability, according to research from Hunters.io reported by Cyber Security News.
Key facts
What happened: Attackers compromised 3,562 internet-exposed Redis servers that accepted commands without authentication, out of 12,966 scanned targets
How: Abuse of Redis's legitimate master-replica replication feature to plant a cron job that downloads and runs the XMRig miner
Affected versions: Redis 2.8.17 through 7.2.0 — configuration, not a vulnerable version, was the problem
Impact: Degraded performance, higher cloud bills, and potential data-loss risk from altered persistence settings
What to do: Take Redis off the public internet, require authentication, and restrict replication commands
How did attackers compromise the Redis servers?
No zero-day required. Redis is a popular in-memory database, and by default older configurations can accept commands from anyone who can reach them. After confirming a server required no password, the attackers redirected where Redis wrote its data and made it replicate content from a rogue server they controlled. That replicated data created a cron task — a scheduled Linux job — which every five minutes fetched the XMRig mining software, renamed it to blend in with temporary files, and connected it to a mining pool over encrypted port 443 to make the traffic look routine.
Researchers found the operation's own exposed directory of 147 files, including exploit code and campaign logs, giving an unusually clear view of how it was built and measured. The attackers also tested SSH key injection and Redis scripting approaches, but those produced no confirmed compromises at scale.
Why is cryptojacking still a business risk?
Cryptojacking is the unauthorized use of your computing resources to mine cryptocurrency. It sounds like a nuisance crime, but the costs are real: slower applications, sustained high CPU use, inflated cloud bills — and in this case, a data-integrity risk, because the altered Redis write settings can interfere with the snapshot files organizations rely on for persistence. The same access could just as easily deliver ransomware; the attacker chose mining.
How do you protect Redis servers?
Remove Redis from direct internet access, restrict it to trusted networks, and require authentication. Where replication isn't needed, restrict or rename the SLAVEOF/REPLICAOF commands and keep protected mode enabled. Upgrading alone won't fix this exposure, since the abused feature is legitimate and spans many versions. To hunt for existing compromise: inspect cron directories for unexpected download or mining references, review Redis settings for unusual data directories, and investigate sustained CPU consumption from processes in temporary directories. Full indicators of compromise are in the Hunters.io report.