HeadCrab: A Novel State-of-the-Art Redis Malware

Aqua Nautilus researchers uncovered "HeadCrab", an advanced Redis module malware and botnet that uses the SLAVEOF replication feature to load a memory-only malicious module (via memfd) into exposed Redis servers, enabling stealthy cryptomining (XMRig), encrypted C2, reverse shells, kernel-module loading, and persistence; the report includes a technical breakdown, IOCs (MD5, Monero wallet, IPs), detection methods, MITRE mappings, and remediation/hardening recommendations.