Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files

Executive summary: Analysts recovered an exposed operator working directory that documents a large-scale cryptomining campaign which abused unauthenticated Redis replication (SLAVEOF) to push crafted RDB blobs that install cron-based XMRig miners; parsing of operator logs shows 3,562 distinct confirmed compromises, corroborated C2 endpoints, a linked Monero wallet (including operator self-mining), multiple fallback persistence methods, and a set of IOCs and remediation guidance.