Reported by 2 outlets

Timeline

1. original reporting

   Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

   hunt.io · 35d ago · September 8th, 2026

   An operator running a Redis cryptomining botnet left their entire working directory exposed on a server. Instead of the usual single payload, the whole toolkit was there: exploit code, raw campaign logs, a bundled Python runtime, even two exported Windows registry hives. That let us read their own campaign logs instead of guessing: 3,562 distinct Redis servers compromised, out of 12,966 targeted Only one technique actually worked at scale, an abuse of Redis replication that drops a cron job to run XMRig Their SSH and MongoDB attempts returned zero Victims run Redis versions spanning eight years, so the problem is missing authentication, not an unpatched bug The same crypto wallet ties this back to an earlier February 2026 campaign, so the operator has been at it for months The fix is confi

   via reddit r/cybersecurity: Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

2. update from securityonline.info

   A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked. # Redis

   securityonline.info · 35d ago · September 9th, 2026

   A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked. # Redis

   via Mastodon https://securityonline.info/redis-cryptomining-botnet/?utm_source=mastodon&utm_medium=jetpack_social

3. update from hunt.io

   Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners Indicators extracted from public reporting. Source: https:// hunt.io/b

   hunt.io · 34d ago · September 9th, 2026

   Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners Indicators extracted from public reporting.