Executive Summary
A sophisticated cryptocurrency mining campaign is actively exploiting CVE-2026-90817, a remote code execution (RCE) vulnerability affecting public-facing REDCap servers. The attack chain is notably evasive, utilizing native bash networking for fileless delivery and hiding malicious payloads within steganographic image files to bypass perimeter security controls.
Upon gaining initial access, attackers deploy XMRig miners that masquerade as legitimate system services using randomized syslog-themed names. The campaign includes advanced features such as an automated watchdog that pauses mining during active administrative sessions to avoid detection, and aggressive routines to neutralize competing miners on the host.
The impact is significant for organizations running vulnerable REDCap instances, primarily in the healthcare and research sectors, leading to unauthorized resource consumption and potential long-term persistence through unauthorized SSH key injection. Immediate patching to the latest REDCap version is required to mitigate this threat.