static-urls · Crawled Jul 25, 2026
RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale | Datadog Security Labs
7 IoCs 1 Malware
Read original article ↗
AI Summary
RedisRaider is a Linux cryptojacking campaign that targets publicly exposed Redis servers to deploy a custom XMRig miner. The threat actor uses aggressive scanning, obfuscation techniques, and cron job manipulation to propagate and maintain persistence. The campaign also leverages in-browser mining infrastructure, indicating a multi-pronged monetization strategy. Anti-forensics measures such as short-lived Redis keys and configuration tampering are used to evade detection.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 7 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 58[.]229[.]206[.]107 | Details → |
| Domain | a[.]hbweb[.]icu | Details → |
| Domain | c[.]hbweb[.]icu | Details → |
| SHA-256 | 8d2efe92846cdf9c258f0f7e0a571a8d63c80f0fa321cb2c713fb528ed29ba42 | Details → |
| SHA-256 | 7b2314bf8bf26ce3f3458b0d96921d259ee7b0be1c0b982c2a19d8c435b7e3ae | Details → |
| Filename | /etc/cron.d/apache | Details → |
| Filename | /tmp/mysql | Details → |
MITRE ATT&CK TTPs 61 techniques
T1003.002 Security Account Manager · Credential Access T1012 Query Registry · Discovery T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1027.002 Software Packing · Defense Evasion T1027.003 Steganography · Defense Evasion T1027.013 Encrypted/Encoded File · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.003 Cron · Execution T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1056.002 GUI Input Capture · Collection T1057 Process Discovery · Discovery T1059.001 PowerShell · Execution T1060 T1060 T1070.004 File Deletion · Defense Evasion T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.001 Default Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1085 T1085 T1089 T1089 T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1102.001 Dead Drop Resolver · Command And Control T1105 Ingress Tool Transfer · Command And Control T1106 Native API · Execution T1110 Brute Force · Credential Access T1110.001 Password Guessing · Credential Access T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1135 Network Share Discovery · Discovery T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1160 T1160 T1170 T1170 T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1197 BITS Jobs · Defense Evasion T1203 Exploitation for Client Execution · Execution T1204.002 Malicious File · Execution T1205.001 Port Knocking · Defense Evasion T1212 Exploitation for Credential Access · Credential Access T1484.001 Group Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1543.001 Launch Agent · Persistence T1543.002 Systemd Service · Persistence T1543.003 Windows Service · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1548.004 Elevated Execution with Prompt · Privilege Escalation T1555.003 Credentials from Web Browsers · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1564.003 Hidden Window · Defense Evasion T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1574.002 DLL Side-Loading · Persistence T1608.001 Upload Malware · Resource Development T1685 T1685