#ParsedReport #CompletenessHigh
08-09-2026

Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

https://hunt.io/blog/redis-cryptomining-botnet-3562-servers

Report completeness: High

Threats:
Meterpreter_tool
Xmrig_miner
Xminer
Supply_chain_technique

Victims:
Redis servers, Wordpress sites, Mongodb hosts

Industry:
Logistic, Telco

Geo:
Asia-pacific, Apac, Saudi arabia, China, Moldova, Los angeles, Germany, France, Malaysia, India, Turkish, Palestinian

TTPs:
Tactics: 5
Technics: 1

IOCs:
IP: 11
File: 29
Domain: 2
Path: 6

Soft:
Redis, Windows registry, Linux, Ubuntu, WordPress, curl, Docker, systemd, Google Chrome, Chrome, have more...

Crypto:
monero

Algorithms:
base64, zip

Functions:
phpinfo, load, require, recv, try_ssh, write_file, chr, exec

Languages:
lua, php, python, javascript