Expired Redis Service Abused to Use Metasploit Meterpreter Maliciously

Attackers have compromised an 8-year-old version of the cloud platform to distribute various malware that can take over infected systems.

Attackers are using an 8-year-old version of the
Redis open-source database server
to maliciously use Metasploits Meterpreter module to expose exploits within a system, potentially allowing for takeover and distribution of a host of other malware.
Researchers from AhnLab Security Intelligence Center (ASEC) said
in a blog post
that attackers likely are exploiting inappropriate settings or a vulnerability present in an implementation of Redis to distribute Meterpreter for nefarious use.
Such malware strains attack
Redis servers
open to the public on the Internet with the authentication feature disabled, ASEC researcher Sanseo wrote in the post. After gaining access to Redis, threat actors can install malware through known attack methods.
Meterpreter is an aspect of the legitimate Metasploit pen-testing tool that allows threat actors to fetch various
Metasploit modules
, or working exploits for known bugs, and then use them on the targeted system, according to ASEC. Metasploit is a tool similar to Cobalt Strike that also is oft-abused by threat actors to execute attacks.
When Metasploit is installed, the threat actor can take control of the infected system and also dominate the internal network of an organization using the various features offered by the malware, Senseo explained.
Redis is an open source, in-memory data structure storage service that is increasingly being used in various ways in cloud environments; its primary purpose is typically for session management, message broker, and queues, according to ASEC. This increased prevalence also is making it
a more popular target
for attackers, who have abused vulnerable Redis servers to spread a host of malware, including
Kinsing
, P2PInfect, Skidmap, Migo, and HeadCrab.
By using Metasploit Meterpreter, there are two main attacks methods that actors can employ to spread malware once theyve gained access to Redis. One is to register the malware-executing command as a Cron task, and the other is using the SLAVEOF command to set the command as the Slave server of the Redis server that has the malware.
ASEC witnessed an attack targeting a system that used Windows, along with version Redis 3.x, which was developed in 2016. The age of the abused platform means it was likely vulnerable to attacks that abuse misconfiguration or attacks on known vulnerabilities, Senseo noted.
In the attack, the threat actor first downloaded PrintSpoofer, a privilege escalation tool, in the installation path for Redis. Attackers often use this tool against vulnerable services that are not managed properly or have not been patched to the recent version; in fact, ASEC has witnessed a flurry of these attacks against Redis since the second half of last year.
The difference between the cases from the past and the cases now is that PrintSpoofer is installed using the CertUtil tool instead of PowerShell, Senseo explained.
After installing PrintSpoofer, the threat actor installed Meterpreter Stager — one of two types of the module, the difference between which depends on the way it is installed. Meterpreter is to the Metasploit tool as Beacon is to Cobalt Strike.
When an attacker uses Stager, it means the installation is via the staged version, which downloads Meterpreter directly from the attackers command-and-control (C2) server. This decreases its footprint version downloading it in a stageless way within a payload, according to ASEC.
Once this process is complete, Meterpreter is executed in the memory, which allows the threat actor to take control over the infected system and also dominate the internal network of an organization using the various features offered by the malware, Senseo wrote.
ASEC included a list of files, behaviors, and indicators of compromise of the attack in its post to help network administrators identify evidence of the threat on a system.
To avoid being compromised by the attack vector, ASEC advised that administrators of environments with Redis 3.x installed should, at the very least, update the server immediately with available patches to ensure that known vulnerabilities cant be exploited. The best-case scenario, however, would be to update V3 to the latest version of the server.
Administrators should also install security-protection software that restricts external access to
Redis servers
open to the Internet so they cant be identified and abused, ASEC advised.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Expired Redis Service Abused to Use Metasploit Meterpreter Maliciously