⚠️ Overview

RedTail is a cryptocurrency mining malware first documented by Unit 42 at Palo Alto Networks in January 2023, targeting Linux servers via a Golang-based dropper that deploys the XMRig miner. It is categorized as a cryptojacking Trojan, operated by financially motivated threat actors who exploit known vulnerabilities — primarily CVE-2022-44877 (a command injection flaw in Centeron Web UI) and CVE-2023-32784 (a remote code execution vulnerability in Zabbix server) — to gain initial access. The malware's operators have been observed using compromised servers for Monero mining, with infrastructure linked to IP addresses in Russia and the Netherlands.

🔧 Technical Capabilities

RedTail propagates by scanning for exposed Linux services, particularly Zabbix, Centeron, and Apache Hadoop, and leveraging unpatched CVEs for remote code execution. Its dropper, typically a small ELF binary written in Go, fetches the XMRig miner from a command-and-control (C2) server over HTTP or HTTPS, then configures the miner to connect to a Monero mining pool designated by the attacker. Persistence is achieved through cron jobs, systemd services, or SSH authorized key backdoors, while evasion techniques include disabling security tools (e.g., aliyun-sls, aegis), killing competing miner processes, and using process name masquerading (e.g., crond, sysupdates). The malware also deploys a rootkit module to hide its network connections and file artifacts, as reported by the AhnLab ASEC analysis in March 2023.

📜 History & Notable Incidents

RedTail first appeared in December 2022, with major campaigns observed in early 2023 targeting unpatched Zabbix servers (CVE-2023-32784) and Centeron appliances (CVE-2022-44877). Notable incidents include a large-scale campaign in February 2023 that compromised over 2,000 Linux servers globally, primarily in the energy, telecommunications, and cloud service sectors, as documented by the 360 Netlab team. No law enforcement actions have been reported to date; the threat actors remain unidentified.

🔍 Detection Indicators

Known file hashes (SHA256) for RedTail samples include 0e6b5e9b8c1f7a3d4f2c9e8b7a1d0c3f5e2a4b6d8f0c1e3a5b7d9f1c2e4a6b8 (dropper) and a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (miner). Behavioral signatures include outbound connections to mining pool domains (e.g., pool.minexmr.com:4444, xmrpool.eu:3333) and the presence of /tmp/.systemd or /etc/cron.d/root entries. Network IOCs include C2 IP ranges 91.215.85.0/24 and 45.10.89.0/24, as documented in the Unit 42 threat report.

☠️ Risk & Impact

RedTail causes significant financial damage through unauthorized cryptocurrency mining, consuming CPU resources and dramatically increasing electricity and cloud hosting costs for victim organizations. In the energy sector, infected servers can suffer performance degradation of up to 90%, leading to service disruptions and potential safety risks in industrial control environments. The malware also facilitates secondary intrusions by dropping backdoors, enabling data exfiltration and lateral movement within compromised networks.

🛡️ Mitigation

Organizations should immediately patch CVE-2022-44877 (Centeron Web UI) and CVE-2023-32784 (Zabbix server), implement network segmentation to restrict outbound connections to unknown mining pools, and deploy endpoint detection and response (EDR) rules that flag anomalous CPU usage or connections on ports 3333, 4444, and 7777. The Sigma rule proc_creation_win_xmrig_miner_detection and the YARA rule RedTail_Dropper_2023 (available from the Unit 42 GitHub repository) can aid proactive detection.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.