HeadCrab is a novel, memory-resident Redis malware that has quietly compromised Redis servers worldwide since 2021, forming a botnet of at least 1,200 servers. It loads a custom Redis module via SLAVEOF/master replication, operates entirely in memory to evade disk-based defenses, and mines cryptocurrency while maintaining stealth across infections. #HeadCrab #Redis #XMRIG #Monero #AquaSecurity
Keypoints
- HeadCrab is a sophisticated, in-memory Redis malware that loads via Redis modules to take control of compromised servers.
- The attack starts with a master-slave Redis replication sequence that downloads a malicious module to the Slave (honeypot) server.
- The malware is designed to be memory-only, deletes logs, and avoids disk writes to bypass volume-based and file-based detections.
- It introduces eight custom Redis commands (rds*) to execute its operations and commands, including loading malicious modules and interacting with C2.
- The payload focuses on cryptocurrency mining, with the attacker’s Monero wallet showing significant potential profit per compromised host.
- Detection in the wild leverages low-level eBPF-based monitoring to identify in-memory, stealthy behavior such as in-memory module injections and reverse shells.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The article notes that “default Redis servers that are accessible from the internet” are vulnerable to unauthorized access and command execution.
- [T1021] Lateral Movement – The attackers zombify Redis servers and use them to move laterally to other servers: “move laterally to other servers.”
- [T1543.003] Create or Modify System Process – Linux Service – The malware can install a Linux service, masquerading as sshd: “install systemd service or initd service to /etc/ice9j” and “masquerade as a sshd service.”
- [T1497.001] Virtualization/Sandbox Evasion – The malware checks if it runs in a container by examining the process ID, suggesting container detection: “checks if the process ID is below 31. We speculate that this is done to detect whether the service is running in a container.”
- [T1564.001] Hide Artifacts – In-Memory – The malware runs solely in memory, deletes logs, and avoids disk writes: “memory-only and logs are deleted using the Redis module framework and API.”
- [T1573.001] Encrypted Channel – The malware establishes an encrypted channel with a C2 and uses magic numbers as encryption keys: “establish an encrypted communication channel with a C2 server” and “magic numbers used as encryption keys.”
- [T1496] Resource Hijacking – The primary impact is cryptocurrency mining: “resource hijacking for cryptocurrency mining.”
Indicators of Compromise
- [Monero Wallet] Monero wallet – 85o3miXCHdWduE6V2xTMVsEofzrDoTyquGAXwW35mAPuRtkW6Xf5jET35QNSnHQL68gZNh96RrZBnPuGgwR6FoyoUEhbZJP
- [MD5 Hash] HeadCrab malware MD5 – c5b992c76b7c9fa3b9bd755dd3b5af76
- [IPv4 Address] Redis Master – 116.202.102.79
- [IPv4 Address] Reverse shell – 178.62.32.29
- [IPv4 Address] Mining pool – 44.224.209.130
- [IPv4 Address] Monero pool – 44.224.209.130
- [IPv4 Address] Hijacked mining pool – 182.74.78.10
Read more: https://blog.aquasec.com/headcrab-attacks-servers-worldwide-with-novel-state-of-art-redis-malware