Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners

Cybersecuritynews •Tushar Subhra Dutta • September 9, 2026

A large cryptomining operation has compromised 3,562 Redis servers and turned their processing power into a source of Monero revenue. The campaign did not rely on a newly discovered software flaw. Instead, it targeted internet-facing Redis instances that accepted commands without authentication. The operators scanned 12,966 potential targets, then used Redis replication features to plant […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 3,500 Redis Servers Compromised for Cryptocurrency Mining A large-scale cyber operation has compromised 3,562 internet-exposed Redis servers, exploiting their lack of authentication to convert them into cryptocurrency miners. The attackers targeted a total of 12,966 Redis instances, successfully taking over 22-26% of them using rogue replication techniques. The compromised servers ran various Redis versions from 2.8.17 to 7.2.0 on Linux systems. The attack involved injecting malicious code via the SLAVEOF/replicaof command and subsequently using cron jobs to execute XMRig, a Monero mining software. Hunt.io's analysis revealed that there is no specific CVE for this issue, as the vulnerability stems from poor configuration rather than software flaws. The campaign has been active since at least February 2026, with the operator's tools still in use as of June 2026. Security experts recommend that administrators secure their Redis instances by implementing authentication and restricting network exposure. 1 sources 69

Extracted Entities

Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)