Executive Summary
A detailed investigation of an exposed open directory has revealed a large-scale cryptomining campaign targeting unauthenticated Redis, MongoDB, and WordPress instances. The operator, identified through file artifacts as a Chinese-speaking actor operating from a Windows-based Docker environment, successfully compromised 3,562 distinct Redis servers. The attack primarily leverages Redis's legitimate master-replica replication protocol (SLAVEOF) to inject malicious cron jobs, bypassing the need for traditional software vulnerabilities.
The campaign's infrastructure, centered on the IP 188.245[.]99.156, serves as a C2 and payload delivery hub. Technical artifacts link this activity to a separate February 2026 campaign via a shared Monero wallet, suggesting a persistent and evolving operation. While the primary impact is unauthorized resource consumption for Monero mining, the scanning infrastructure incidentally harvested sensitive data, including SQL dumps and private credentials, from unrelated third-party sites.
This threat highlights the ongoing risk of misconfigured cloud database deployments. The victim pool spans a decade of Redis versions (2.8.17 to 7.2.0), proving that standard security updates are insufficient against configuration-based attacks. Organizations should prioritize securing Redis instances with authentication and restricting administrative commands.