Security analysts at cloud forensics provider Cado Security have discovered a new malware campaign dubbed “Migo” which targets Redis servers for the purpose of exploiting underlying Linux hosts for cryptomining. Analysts at Cado discovered the Migo campaign actively attempting to exploit their Redis honeypot servers. Redis – or Remote Dictionary Server – is a high-performance in-memory data structure store that can be used as a database, cache, or message broker. Redis is a prime target for cryptomining exploits due to its ability to perform thousands of requests per second for real-time applications. According to Cado’s analysis, the Migo payload’s primary function is to install and execute a modified cryptominer from Github’s content delivery network (CDN). Prior to delivering the Migo payload, the attacker disables critical security features on the Redis server to enable external access, to allow writing to replicas, and to create a heavier IO load. Once the Redis server’s shields are weakened, the Migo payload is delivered via a cron job that downloads the script from Pastebin. The Migo malware employs a user-mode rootkit to hide its processes and files to evade detection. The Migo malware establishes persistence and ensures continuous mining for the malicious miner through the creation of a systemd service and timer. Although cryptojacking attacks can be less disruptive to organizations than other forms of cyberattacks, CTIX analysts recommend that organizations leveraging Redis include Migo indicators of compromise (IOCs) with their threat hunting activities, particularly as the malware can open doors to much more nefarious outcomes. CTIX analysts will continue to report on novel and interesting new strains of malware.