Ankura CTIX FLASH Update - February 23, 2024

Malware Activity

Redis Servers Targeted by New 'Migo' Cryptojacking Malware

Security analysts at cloud forensics provider Cado Security have discovered a new malware campaign dubbed "Migo" which targets Redis servers for the purpose of exploiting underlying Linux hosts for cryptomining. Analysts at Cado discovered the Migo campaign actively attempting to exploit their Redis honeypot servers. Redis – or Remote Dictionary Server – is a high-performance in-memory data structure store that can be used as a database, cache, or message broker. Redis is a prime target for cryptomining exploits due to its ability to perform thousands of requests per second for real-time applications. According to Cado's analysis, the Migo payload's primary function is to install and execute a modified cryptominer from Github's content delivery network (CDN). Prior to delivering the Migo payload, the attacker disables critical security features on the Redis server to enable external