HeadCrab Botnet Targets 1,200 Redis Servers in a New Elusive Campaign

What’s happening?

• The attackers have gone to great lengths to ensure that the malware bypasses the volume-based scans on the system’s memory. 
• Additionally, logs are deleted using the Redis module framework and API.
• As a part of the evasion strategy, the attackers use legitimate IP addresses of other infected servers for communication and to reduce the likelihood of being blacklisted by security solutions.

More about HeadCrab botnet

• Upon initial execution, the botnet utilizes the ‘RedisModule_OnLoad’ function that is triggered when the Redis server loads the module.
• In the later stage, it creates new Redis commands to enable its operators to perform multiple malicious activities such as replacing default commands with malicious functions to evade detection, updating the magic numbers used in encryption, and listening to an incoming connection on a port.

Redis servers - a hotbed of criminals

• In December, a new Go-based malware called Redigo was discovered targeting Redis servers. The malware used a Redis vulnerability to propagate across networks.
• Furthermore, a threat actor had hacked around 39,000 of these unauthenticated servers to install a cryptocurrency miner. A majority of these servers were located in China, followed by the U.S., France, Germany, the Netherlands, Ireland, Singapore, and Hong Kong.

Recommendations