REDIScovering HeadCrab - A Technical Analysis of a Novel Malware and the Mind Behind It
summary
Detailed technical forensics of HeadCrab shows a malware framework that abuses Redis slaveof/replicaof to drop and modu load payloads, implements custom Redis Modules, then evolves to an mget-based encrypted C2 and a rootkit by patching Redis command pointers. It ships a separate ice9j credential stealer using fa_notify hooks and proc memory reads, reinjects modules via memfd/tmp to avoid disk, persists by padding redis.conf, and conducts crypto mining. Operators find 3,300 infected servers worldwide and demonstrate the techniques work.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 10:44Technical analysis
- 21:03Victim analysis and scale
- 23:25Attacker communication
- 28:48Credential stealing tool
- 33:24Headcrab 2.0 release
- 36:25Conclusion and Q&A
related talks
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting
50mThe Anatomy of Cloud Attacks
42mDriven Response to UNC5174
01h 06mComputrace Backdoor Revisited
46mAttacks, Lies and the Underground World
15mTales from the Underground: Hilarious Cybercrime Fails!!
26mTracking the World's Dumbest Cyber Mercenaries
39mHow to think like a hacker