Over A Thousand Redis Servers Have Been Compromised To Mine Cryptocurrency

More than a thousand Redis servers were infected by custom-built malware called HeadCrab, researchers have reported.

The malware made the endpoints mine Monero, a privacy-oriented cryptocurrency and hacker favorite.

Cybersecurity researchers from Aqua Security’s Nautilus discovered a botnet spanning 1,200 Redis servers, which were infected in the last year and a half. The servers were located in the US, UK, Germany, India, Malaysia, China, and other countries, and besides being Redis servers, they had no other links.

Authentication off by default

“The victims seem to have little in common, but the attacker seems to mainly target Redis servers and has a deep understanding and expertise in Redis modules and APIs, as demonstrated by the malware,” researchers Asaf Eitani and Nitzan Yaakov said.

As it turns out, open-source Redis database servers have authentication turned off by default, allowing threat actors to access them and execute code remotely without needing to authenticate as a user. Many Redis users forgot to turn on the authentication feature, exposing their endpoints to attackers.

What’s more, Redis clusters use master and slave servers for data replication and synchronization, allowing the attackers to use the default SLAVEOF command and set the target endpoint as a slave to a Redis server they already control. That allows them to deploy the HeadCrab malware.

The researchers don’t know who hides behind the campaign, but looking at their cryptocurrency wallets, they deduced that they bring in about $4,500 per infected device per year.

“We have noticed that the attacker has gone to great lengths to ensure the stealth of their attack,” the researchers added.

Monero is arguably the most popular cryptocurrency among hackers engaging in cryptojacking. Over the years, there have been countless reports of criminals deploying XMRig, a popular Monero miner, to servers and data centers around the world, raking up huge electricity bills for the victims, all the while rendering their servers practically useless.

Via: The Register