Massive Redis Cryptomining Botnet Compromises 3,562 Servers

• •3,562 Redis servers compromised due to missing authentication.
• •Attack exploited CVE-2024-21762 against a Thai broadband provider's SSL-VPN.
• •Operator's toolkit was exposed, revealing extensive attack methods.

A cryptomining botnet has compromised 3,562 Redis servers, primarily due to missing authentication. The attack targeted a shared list of 12,966 hosts, with a significant success rate of 22-26%. The compromised servers span Redis versions from 2.8.17 to 7.2.0 and various Linux distributions, indicating a lack of security measures rather than specific vulnerabilities. The botnet's operator inadvertently exposed their toolkit, which included Python exploits and campaign logs. Additionally, a Thai broadband provider was targeted through a FortiGate SSL-VPN vulnerability (CVE-2024-21762), with evidence of persistent backdoor access via MeshCentral. The attack's infrastructure was discovered on June 3, 2026, and the threat actor had knowledge of organization-specific credentials. The situation remains critical as the botnet continues to exploit vulnerable Redis servers.