• Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
MUST READ

U.S. CISA urges FCEB agencies to fix two Microsoft SharePoint flaws immediately and added them to its Known Exploited Vulnerabilities catalog

 | 

Sophos fixed two critical Sophos Firewall vulnerabilities

 | 

French Authorities confirm XSS.is admin arrested in Ukraine

 | 

Microsoft linked attacks on SharePoint flaws to China-nexus actors

 | 

Cisco confirms active exploitation of ISE and ISE-PIC flaws

 | 

SharePoint under fire: new ToolShell attacks target enterprises

 | 

CrushFTP zero-day actively exploited at least since July 18

 | 

Hardcoded credentials found in HPE Aruba Instant On Wi-Fi devices

 | 

MuddyWater deploys new DCHSpy variants amid Iran-Israel conflict

 | 

U.S. CISA urges to immediately patch Microsoft SharePoint flaw adding it to its Known Exploited Vulnerabilities catalog

 | 

Microsoft issues emergency patches for SharePoint zero-days exploited in "ToolShell" attacks

 | 

SharePoint zero-day CVE-2025-53770 actively exploited in the wild

 | 

Singapore warns China-linked group UNC3886 targets its critical infrastructure

 | 

U.S. CISA adds Fortinet FortiWeb flaw to its Known Exploited Vulnerabilities catalog

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 54

 | 

Security Affairs newsletter Round 533 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

Radiology Associates of Richmond data breach impacts 1.4 million people

 | 

Fortinet FortiWeb flaw CVE-2025-25257 exploited hours after PoC release

 | 

Authorities released free decryptor for Phobos and 8base ransomware

 | 

Anne Arundel Dermatology data breach impacts 1.9 million people

 | 
  • Home
  • Cyber Crime
  • Cyber warfare
  • APT
  • Data Breach
  • Deep Web
  • Digital ID
  • Hacking
  • Hacktivism
  • Intelligence
  • Internet of Things
  • Laws and regulations
  • Malware
  • Mobile
  • Reports
  • Security
  • Social Networks
  • Terrorism
  • ICS-SCADA
  • POLICIES
  • Contact me
  • Home
  • Breaking News
  • Cyber Crime
  • Hacking
  • Malware
  • A new sophisticated SkidMap variant targets unsecured Redis servers

A new sophisticated SkidMap variant targets unsecured Redis servers

Pierluigi Paganini August 07, 2023

A new campaign targets Redis servers, this time the malware employed in the attacks is a new variant of the SkidMap malware.

Skidmap is a piece of crypto-miner detected by Trend Micro in September 2019 while it was targeting Linux machines. The malicious code used kernel-mode rootkits to evade detection, it differs from similar miners because of the way it loads malicious kernel modules.

Trustwave researchers spotted a new, improved, and dangerous Skidmap variant, which was designed to target a wide range of Linux distributions, including  Alibaba, Anolis, openEuler, EulerOS, Steam, CentOS, RedHat, and Rock.

Skidmap

The variant analyzed by the researchers was observed targeting only open Redis instances (so-called ‘NO AUTH’). No brute-force attacks were observed by the researchers.

“Accordingly, we will distinguish between the two main Linux variants that influenced the infection flow. The first variant is Debian/Ubuntu, the second is RedHat/CentOS.” reads the report published by Trustwave. “The malicious nature of this malware is to adapt to the system on which it is executed. The most important thing for us was to reach down, reveal and describe crucial elements of the rogue application, and thus cut off – we hope – a large part of the earnings from this criminal activity.”

The attack chain starts with an attempt to login to the unsecured Redis instance and set up variables containing base64-encoded cron tasks.

The Cron runs a job every 10 minutes by alternating between ‘curl’ and ‘wget’ to download and execute the dropper script.

Trustwave observed threat actors deploying a dropper shell script that’s designed to distribute the binary executable file (ELF) that masquerades as a GIF image file (while a previous version of the malware used ‘jpeg’).

Once the shell script is deployed, the malware adds ssh keys in standard locations: ‘/root/.ssh/authoried_keys’ and ‘/root/.ssh/authoried_keys2’.

Then the malicious code disables the SELinux and creates a reverse shell that will call back to the C2 every hour via TCP/8443 port.

Depending on the specific Linux distribution and kernel, the malware downloads an appropriate package (named gold, stream, or euler).

The package uses several shell scripts to install the kernel modules, including one to purge the logs and launch a bot that allows operators to retrieve additional rootkit payloads. The mcpuinfo.ko payload is used to hide the miner, while kmeminfo.ko allows the malicious code to inspect network packets and manipulate them. Some variants observed by the experts included a built-in miner.

“The level of advancement of this malware is really high, and detecting it, especially in larger server infrastructures, can be very hard. When testing it on home computers, the only serious indicator that something was wrong was the excessive operation of fans, and in the case of laptops, the temperature of the case” concludes the report that also includes Indicators of Compromise (IoCs). “And finally, what about Redis? Exploiting this flaw doesn’t look complex. And it’s true. Redis is vulnerable by design, and its place is not at the edge of the network. It was designed for a closed environment, and security features were added in later releases.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, malware)


facebook linkedin twitter

Cybercrime Hacking hacking news information security news IT Information Security malware miner Pierluigi Paganini Redis Security Affairs Security News SkidMap

you might also like

Pierluigi Paganini July 23, 2025
U.S. CISA urges FCEB agencies to fix two Microsoft SharePoint flaws immediately and added them to its Known Exploited Vulnerabilities catalog
Read more
Pierluigi Paganini July 23, 2025
Sophos fixed two critical Sophos Firewall vulnerabilities
Read more

leave a comment

newsletter

Subscribe to my email list and stay
up-to-date!

    recent articles

    U.S. CISA urges FCEB agencies to fix two Microsoft SharePoint flaws immediately and added them to its Known Exploited Vulnerabilities catalog

    Hacking / July 23, 2025

    Sophos fixed two critical Sophos Firewall vulnerabilities

    Security / July 23, 2025

    French Authorities confirm XSS.is admin arrested in Ukraine

    Cyber Crime / July 23, 2025

    Microsoft linked attacks on SharePoint flaws to China-nexus actors

    APT / July 23, 2025

    Cisco confirms active exploitation of ISE and ISE-PIC flaws

    Hacking / July 22, 2025

    To contact me write an email to:

    Pierluigi Paganini :
    pierluigi.paganini@securityaffairs.co

    LEARN MORE

    QUICK LINKS

    • Home
    • Cyber Crime
    • Cyber warfare
    • APT
    • Data Breach
    • Deep Web
    • Digital ID
    • Hacking
    • Hacktivism
    • Intelligence
    • Internet of Things
    • Laws and regulations
    • Malware
    • Mobile
    • Reports
    • Security
    • Social Networks
    • Terrorism
    • ICS-SCADA
    • POLICIES
    • Contact me

    Copyright@securityaffairs 2024

    We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
    Cookie SettingsAccept All
    Manage consent

    Privacy Overview

    This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
    Necessary
    Always Enabled
    Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
    Non-necessary
    Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
    SAVE & ACCEPT