Over a thousand Redis servers hijacked to mine crypto

Date:
Mon, 06 Feb 2023 19:22:20 +0000

Description:
Default settings allowed crooks easy access to roughly 1,200 Redis servers.

FULL STORY ======================================================================

More than a thousand Redis servers were infected by custom-built malware called HeadCrab, researchers have reported.

The malware made the endpoints mine Monero, a privacy-oriented
cryptocurrency, and a hacker favorite.

Cybersecurity from Aqua Securitys Nautilus discovered a botnet spanning 1,200 Redis servers, which were infected in the last year and a half. The servers were located in the US, the UK, Germany, India, Malaysia, China, and other countries, and besides being Redis servers, have no other links. Authentication off by default

"The victims seem to have little in common, but the attacker seems to mainly target Redis servers and has a deep understanding and expertise in Redis modules and APIs as demonstrated by the malware," researchers Asaf Eitani and Nitzan Yaakov said.

As it turns out, open-source Redis database servers have authentication off
by default, allowing threat actors to access them and execute code remotely, without needing to authenticate as a user. Apparently, many Redis users
forgot to switch the authentication feature on, exposing their endpoints to attackers.

Whats more, Redis clusters use master and slave servers for data replication and synchronization, allowing the attackers to use the default SLAVEOF
command and set the target endpoint as a slave to a Redis server they already control. That allows them to deploy the HeadCrab malware. Read more

Windows and Linux servers turned into crypto miners

This new Linux malware floods machines with cryptominers and DDoS bots

Check out the best firewalls around

The researchers dont know who hides behind the campaign, but looking at their cryptocurrency wallets, deduced that they bring in about $4,500 per infected device, a year.

"We have noticed that the attacker has gone to great lengths to ensure the stealth of their attack," the researchers added.

Monero is arguably the most popular cryptocurrency among hackers engaging in cryptojacking. Over the years there had been countless reports of criminals deploying XMRig, a popular Monero miner, to servers and data centers around the world, raking up huge electricity bills to the victims, all the while rendering their servers practically useless. Stay safe with the best ransomware removal

Via: The Register



======================================================================
Link to news story: https://www.techradar.com/news/over-a-thousand-redis-servers-hijacked-to-mine- crypto


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)