HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining

Researchers disclosed HeadCrab 2.0, an evolved Redis-targeting malware that increasingly compromises internet-exposed Redis servers to form a crypto-mining botnet and enable remote command execution, fileless kernel module loading, and data exfiltration. The new variant abandons disk-based artifacts in favor of a fileless loader and leverages the Redis MGET command for stealthy C2, with Aqua reporting roughly 1,100 additional infected servers—evidence of active, financially motivated adaptation by the operator.