DEV Community

Shubham Chaudhary
Shubham Chaudhary

Posted on

3,562 Redis Servers Hacked for Crypto Mining — No CVE, Just a Missing Password

#cybersecurity #redis #devsecops #infosec

Threat intel firm Hunt.io uncovered a campaign that compromised 3,562 internet-exposed Redis servers — and the attackers didn't need an exploit, a CVE, or a zero-day. They just found servers with no password set.

The Attack Chain

This abuses a completely legitimate Redis feature: master-replica replication.

  1. Scan for Redis instances with no requirepass and protected-mode disabled
  2. Redirect the working directory and filename using CONFIG SET
  3. Force a rogue sync via SLAVEOF/REPLICAOF, pulling a crafted RDB file from an attacker-controlled host
  4. Persistence: that RDB file lands as a valid cron entry (commonly /etc/cron.d/redis-miner)
  5. Deploy: cron fetches XMRig and starts mining Monero over port 443, disguised as normal TLS traffic

Affected servers ran versions 2.8.17 to 7.2.0 — an 8-year spread confirming this is a configuration issue, not a patching one.

Why It's More Than "Just a Miner"

  • Data integrity risk — the same file-write mechanism can corrupt RDB backups
  • Foothold potential — any technique that writes arbitrary files via replication could drop SSH keys or a web shell instead

Check Yourself Right Now 

redis-cli -h <host> CONFIG GET requirepass
Enter fullscreen mode Exit fullscreen mode

An empty result means you're exposed.

Quick Hardening Checklist

  • Never expose Redis directly to the internet — bind to localhost/private VPC
  • Set requirepass or use Redis 6+ ACLs
  • Keep protected-mode enabled
  • Rename/disable SLAVEOF/REPLICAOF if replication isn't used
  • Restrict CONFIG command access to admin accounts only
  • Audit cron directories on a schedule, not just during IR

Full breakdown, IOCs, and detection commands for SOC teams:
🔗 https://www.xpert4cyber.com/2026/09/redis-servers-hacked-crypto-mining.html

Top comments (0)