Over 3,500 Redis Servers Compromised for Cryptocurrency Mining

• •3,562 Redis servers compromised for cryptocurrency mining.
• •Attackers exploited lack of authentication on internet-facing Redis instances.
• •No specific CVE exists; the issue is due to misconfiguration.

A large-scale cyber operation has compromised 3,562 internet-exposed Redis servers, exploiting their lack of authentication to convert them into cryptocurrency miners. The attackers targeted a total of 12,966 Redis instances, successfully taking over 22-26% of them using rogue replication techniques. The compromised servers ran various Redis versions from 2.8.17 to 7.2.0 on Linux systems. The attack involved injecting malicious code via the SLAVEOF/replicaof command and subsequently using cron jobs to execute XMRig, a Monero mining software. Hunt.io's analysis revealed that there is no specific CVE for this issue, as the vulnerability stems from poor configuration rather than software flaws. The campaign has been active since at least February 2026, with the operator's tools still in use as of June 2026. Security experts recommend that administrators secure their Redis instances by implementing authentication and restricting network exposure.