RedisRaider is a new hacking campaign developed in Go that infects Linux servers with the XMRig cryptominer, exploiting vulnerabilities in Redis instances.

RedisRaider is a new Go-based hacking campaign that infects Linux servers with the XMRig cryptominer by exploiting vulnerabilities in Redis instances.

Researchers from Datadog Security Labs have discovered RedisRaider, a massive IPv4 scanning operation that aims to exploit Redis configuration. The goal is to deploy the XMRig miner and then self-propagate the malware. RedisRaider uses Redis commands (`CONFIG`, SET`) to add `cron` jobs to `/etc/cron.d`, which load the Go attacker from a remote server. The infected hosts then launch the Monero miner (XMRig), which then spreads to other Redis instances. The campaign uses obfuscation techniques: TTL keys, configuration changes, and log minimization.

RedisRaider is not the first example of cryptojacking via unsecured Redis. Redis, a popular NoSQL database, has repeatedly become an attack vector, especially if ports are open without authentication. At the same time, Guardz reports an attack on Microsoft Entra ID via BAV2ROPC, which allows you to bypass MFA – an indicator of systemic abuse of outdated protocols.

RedisRaider demonstrates that even legitimate functions can be used as a weapon. Vulnerable Redis servers become entry points for cryptojacking and further attacks. It is worth immediately closing open Redis, restricting access using a firewall, monitoring cron, and disallowing writing to `/etc/cron.d.