REDISRAIDER: WEAPONIZING MISCONFIGURED REDIS TO MINE CRYPTOCURRENCY AT SCALE

Summary from the TLDR InfoSec newsletter

RedisRaider is a new Linux malware campaign that scans the internet for public Redis servers running on Linux and then abuses the Redis SET command to inject a cron job. The cron job downloads the RedisRaider binary to /tmp/mysql, makes it executable, and then executes it using nohup. The RedisRaider binary is a heavily obfuscated dropper for a modified version of the XMRig cryptominer that uses a custom packer to further complicate reversing and forensic analysis.