NEKOBYTE

NEKOBYTE is a long-running cryptomining botnet focused on compromising internet-exposed Redis servers that lack authentication. The operation has been active since at least July 2023 and is characterized by durable persistence, repeated infrastructure maintenance, and automated deployment of a cryptocurrency miner based on XMRig or an XMRig fork. The actor’s tradecraft centers on abusing Redis administrative functionality, specifically CONFIG SET and SAVE, to write attacker-controlled data into the system crontab for the root account. On compromised systems, NEKOBYTE plants multiple persistent Redis keys that create staggered cron jobs using several retrieval methods and fallback mechanisms. This redundancy supports resilience against partial remediation or tooling differences on victim hosts. The cron-based persistence is especially durable because the injected Redis keys can remain indefinitely unless explicitly removed, allowing payload delivery to resume if attacker-controlled infrastructure is restored. Observed behavior shows a straightforward but operationally mature intrusion pattern: identification of exposed Redis services, unauthorized modification of Redis configuration, establishment of cron-based persistence, retrieval of shell-based droppers through multiple command-line utilities and Python-based fallback logic, and deployment of a Monero miner. The campaign demonstrates persistence, initial access through exposed services, defense evasion via obfuscated retrieval logic, and post-exploitation focused on resource hijacking for cryptocurrency mining. NEKOBYTE appears financially motivated. Available evidence directly supports targeting of misconfigured Redis infrastructure rather than a specific vertical or geography. The operator has maintained and rotated payload-hosting infrastructure across multiple providers and countries over an extended period, indicating sustained upkeep rather than one-off opportunistic abuse. No high-confidence attribution to a nation state is supported.