TA-NATALSTATUS Turns Exposed Redis Servers Into Persistent Cryptojacking Infrastructure

Aug 21, 2025 · Original article ↗

Summary

CloudSEK details TA-NATALSTATUS’s use of exposed, unauthenticated Redis servers to install persistent cryptominers, evade detection, and scan for more victims. The report includes indicators, investigation steps, and remediation guidance.

Key points

The actor targets publicly exposed, unauthenticated Redis servers, using Redis commands to write a malicious root cron job when Redis runs with root privileges.
Its malware mines cryptocurrency, hides processes by replacing system binaries, renames download tools, alters file timestamps, and disables host defenses.
Compromised hosts scan for new Redis victims using distributed address-space scanning and can download and compile scanning tools.
Hourly persistence scripts reinstall components; immutable file attributes and an SSH backdoor key help maintain access.
The report provides malware paths, domains including natalstatus[.]org and avspbx[.]com, IP addresses, hashes, and indicators associated with rival cryptojacking campaigns.
CloudSEK recommends isolating and re-imaging affected hosts where possible, removing persistence and backdoors, restoring system binaries, and restricting Redis to localhost with authentication.

Article Details

Attack Vectors: TA-NATALSTATUS scans for publicly exposed, unauthenticated Redis servers, including on port 6379, using masscan.
When Redis is running as root, the actor uses Redis CONFIG SET and SAVE commands to write a malicious cron job into /var/spool/cron/root, which downloads and executes malware.
Compromised hosts are used to scan additional IPv4 address space and propagate the infection.
Defensive Notes: Isolate suspected infected hosts and re-image them from a known-good backup where possible.
Secure Redis with a strong password and configure it to listen only on the local interface; do not run Redis as root.
Check cron locations for suspicious jobs, inspect files for immutable attributes, check authorized_keys for the key comment uc1, and verify that system binaries such as ps, top, curl, and wget have not been replaced.
Restore altered system binaries and remove persistence mechanisms and backdoor files after unlocking immutable files.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`a[.]natalstatus[.]org`	Listed as a confirmed malicious domain associated with TA-NATALSTATUS.
DOMAIN	`avspbx[.]com`	Listed as a confirmed malicious domain associated with TA-NATALSTATUS.
DOMAIN	`dev[.]fugglesoft[.]me`	Identified as a pool domain associated with the threat activity.
DOMAIN	`en2an[.]top`	Listed as a confirmed malicious domain associated with TA-NATALSTATUS.
DOMAIN	`natalstatus[.]org`	Listed as a confirmed malicious domain associated with TA-NATALSTATUS.
DOMAIN	`pyats[.]top`	Listed as a confirmed malicious domain associated with TA-NATALSTATUS.
IPV4	`103[.]79[.]77[.]16`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`104[.]248[.]4[.]162`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`107[.]174[.]47[.]156`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`107[.]174[.]47[.]181`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`121[.]42[.]151[.]137`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`144[.]217[.]45[.]45`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`176[.]31[.]6[.]16`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`181[.]214[.]87[.]241`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`185[.]19[.]33[.]145`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`188[.]209[.]49[.]54`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`194[.]110[.]247[.]97`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`200[.]68[.]17[.]196`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`45[.]76[.]122[.]92`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`45[.]89[.]52[.]41`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`46[.]243[.]253[.]15`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`51[.]15[.]56[.]161`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`51[.]38[.]191[.]178`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`51[.]38[.]203[.]146`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`79[.]137[.]195[.]151`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`80[.]211[.]206[.]105`	Listed as confirmed malicious C2 or mining-pool infrastructure.
IPV4	`83[.]220[.]169[.]247`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
IPV4	`89[.]35[.]39[.]78`	Listed as rival malware infrastructure targeted for termination by TA-NATALSTATUS.
SHA256	`04ae5583ebb88d197f203da92cbc17e5deedd2dc2297b30713ffe697102766b8`	Hash listed for the rs.sh malware script.
SHA256	`254d0672515295890354a58cb6f83758e8eceee9bb5b7c5be08813496e59f24a`	Hash listed for the ndt.sh malware script.
SHA256	`58eeceb920a460a5f389acb23e5f8d86c3391788f9c9f5a4b396e3f4f84782c3`	Hash listed for a malware-related file identified as Dat file.
SHA256	`cc6e21845299c549a439321ff00033caa56e6c28c039b3316b808698f14344c7`	Hash listed for a malware-related file named script.sh.
SHA256	`f0ff790b0eb3479ab90889223b88826be95051a7170285774b4a06b6d34d0771`	Hash listed for the nnt.sh malware script.