Headcrab

Malware updated 4 months ago (2024-05-04T17:29:49.074Z)
Download STIX
Preview STIX
HeadCrab is a sophisticated malware that targets Redis servers, a popular in-memory data structure store often used as a database or cache. First detected by Aqua Security in September 2021, HeadCrab has evolved to operate in memory, making it harder for antivirus systems to detect. It is estimated to have infected over 1,200 Redis servers globally. The malware typically gains access when system administrators leave Redis servers open to external connections without proper authentication. Once infiltrated, HeadCrab installs a botnet to mine cryptocurrency. The unique feature of the HeadCrab malware is its "mini blog", where the author shares technical details about the malware and leaves an anonymous Proton Mail email address. This malware can control a function and send a response, although it's not considered a traditional rootkit. It has been linked to other attacks involving Kinsing, P2PInfect, Skidmap, Migo, and more. In previous campaigns, researchers from Aqua found that threat actors infected over 1,200 Redis servers with a cryptominer using this almost undetectable malware tool. To protect against HeadCrab infections, organizations are advised to regularly scan for vulnerabilities and misconfigurations in their servers and use protected mode in Redis. The malware infects a Redis server when the attacker uses the SLAVEOF command, downloads a malicious module, and runs two new files: a cryptominer and a configuration file. As such, due diligence and regular monitoring of Redis servers are critical to prevent potential breaches.
Description last updated: 2024-04-11T22:16:38.876Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Botnet
Redis
Malware
Rootkit
Cryptominer
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
IDTypeVotesProfile Description
ProtonUnspecified
2
Proton is a malicious software or malware that exploits and damages computer systems, often infiltrating without the user's knowledge. It has been associated with suspicious downloads, emails, or websites and can steal personal information, disrupt operations, or hold data for ransom once it infects
Source Document References
Information about the Headcrab Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
DARKReading
5 months ago
Expired Redis Service Abused to Use Metasploit Meterpreter Maliciously
DARKReading
6 months ago
Cloud-y Linux Malware Rains on Apache, Docker, Redis & Confluence
CERT-EU
9 months ago
'HeadCrab' Malware Variants Commandeer Thousands of Servers
DARKReading
9 months ago
'HeadCrab' Malware Variants Commandeer Thousands of Servers
CERT-EU
a year ago
Google puts $1M behind its mining-malware detection promise
CSO Online
a year ago
Fileless attacks surge as cybercriminals evade cloud security defenses
CERT-EU
2 years ago
Patches, crooks, spies, privateers, and mercenaries
CERT-EU
a year ago
Memory-based attacks increase as attackers dodge cloud defenses
CERT-EU
a year ago
New P2PInfect Worm Targets Redis Servers with Undocumented Breach Methods
CERT-EU
2 years ago
New Cryptojacking Campaign Leverages Misconfigured Redis Database Servers
CERT-EU
a year ago
P2PInfect: New Peer-to-Peer Worm Targeting Redis Servers
CERT-EU
2 years ago
พบมัลแวร์ HeadCrab มุ่งเป้าโจมตี Redis Server