TL;DR

• Lock down Redis now: require auth, bind to localhost/VPC, and segment networks.

• Hunt for stealth: detect renamed system tools (ps, top, curl, wget), immutable files, and rogue cron jobs.

• Kill persistence: remove miners, backdoors, and file immutability; rebuild binaries from known-good sources.

• Monitor resources: alert on sudden CPU spikes, outbound mining pools, and process cloaking.

• Instrument evidence: collect Redis command logs and host artifacts before remediation to preserve attribution.

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Tired of writing intellingence reports? Not sure if you should trust your AI generated report?

• write a report on ‘TA-NATALSTATUS Cryptojacking Campaign’

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

Why it matters

SOC

• Unusual Redis commands on port 6379 from external IPs (e.g., CONFIG SET, SLAVEOF, MODULE LOAD).
• Host with high CPU for kworker/unknown processes and no matching ps/top entries.
• Outbound to mining pools (Stratum protocol on 3333/4444/5555) or DNS lookups for pool domains.

IR

• Triage for tampered binaries (/bin/ps, /usr/bin/top) and immutable flags (chattr +i).
• Preserve /etc/crontab, /var/spool/cron/*, SSH keys, /tmp droppers, Redis logs, and network PCAPs.
• Snapshot process tree, loaded kernel modules, and hash any “replaced” utilities from rescue media.

SecOps

• Enforce Redis hardening: requirepass, bind 127.0.0.1, protected-mode yes, security groups/ACLs.
• Deploy EDR (endpoint detection and response) with file-integrity monitoring on system utilities.
• Block egress to known mining pools; apply least-privilege IAM on cloud nodes/images.

Strategic

• Treat exposed Redis as a business risk: downtime, cloud spend blowouts, and IR cost.
• Add cryptojacking KPIs to cyber metrics (time-to-contain, extra cloud cost avoided).
• Require quarterly scans for internet-exposed services and misconfiguration audits.

Jargon quick defs:
cryptojacking = hijacking compute to mine cryptocurrency;
TTPs = tactics/techniques/procedures;
“rootkit-style binary hijacking” = replacing/renaming system tools to hide;
immutable file lock = chattr +i preventing edits.

The story in 60 seconds

Who/what/why: TA-NATALSTATUS is abusing unauthenticated or poorly configured Redis to gain root and mine crypto at scale. Activity is sustained in 2025 and confirmed through Aug 25, 2025, with high exposure in Finland, Russia, Germany, and the US.

How (TTPs): The actor uses native Redis commands to drop payloads, set persistence via cron, and add SSH backdoors. They rename common admin tools (ps, top, curl, wget) to blind operators, toggle immutable flags on their files, and run scanners (masscan, pnscan) for spread/lateral recon. They also kill rival miners (e.g., Kinsing) to monopolize hardware.

Impact: Cloud/critical infrastructure and tech/manufacturing/media see the worst cost and disruption. Misconfigurations + weak egress controls = long dwell time and bloated cloud bills.

See it in your telemetry

• Mail: N/A (campaign is infrastructure-driven, not phish-first).

• Endpoint (Linux):

  • Hash/size mismatch for /bin/ps, /usr/bin/top; binaries with recent unexpected mtime.
  • crontab -l shows unknown entries; /etc/rc.local or systemd services calling miners.
  • Files or dirs with immutable attribute (lsattr) tied to miner paths in /tmp, /var/tmp, /opt.

• Network:

  • External access to Redis :6379 from the internet; CONFIG, SLAVEOF, or module load attempts.
  • Egress to Stratum pools, persistent TCP to unknown hosts on 3333/4444/5555; DNS for pool.*.
  • Lateral scanning bursts: masscan/pnscan signatures and SYN floods to common service ports.

• Redis:

  • redis-cli MONITOR/audit logs show unauthorized CONFIG SET, key writes from unknown IPs.
  • Unexpected dir/dbfilename changes pointing to writable system paths.

• Cloud:

  • Sudden CPU credit depletion (burstable types), cost spikes, or autoscaling anomalies on Redis hosts.
  • Instances with public IPs lacking SG/NSG restrictions; missing private endpoints/VPC peering.

High Impact, Quick Wins

• Close the front door (now): Restrict Redis to localhost/VPC and require auth; verify with nmap from outside. Sell it: stops active theft today. Measure: exposed-to-internet count → 0; failed external connects logged.

• Restore system truth: Replace tampered utilities from gold images, remove chattr +i, nuke rogue cron/systemd entries, and redeploy from clean AMIs. Sell it: removes attacker invisibility. Measure: file-integrity baseline clean, no anomalous CPU over 72 hours.

• Choke egress: Block mining pools and Stratum at firewall/proxy; alert on future attempts. Sell it: hard dollar savings on cloud bills. Measure: outbound pool connections → 0; monthly compute spend variance back to baseline.

Suggested Pivots

1. Which specific persistence and ... (SUBSCRIBE TO UNLOCK!) ..., and how can endpoint detection and response (EDR), security information and event management (SIEM), and file integrity monitoring systems be optimized to detect these behaviors in real time?

2. Given the high exposure rates of (SUBSCRIBE TO UNLOCK!) ..., how can threat intelligence and vulnerability management programs prioritize defensive measures across these geographic regions and critical sectors (cloud infrastructure, critical infrastructure, technology, manufacturing, media) to reduce the attack surface exploited by TA-NATALSTATUS?

3. How does TA-NATALSTATUS’s aggressive elimination of rival (SUBSCRIBE TO UNLOCK!) ..., and what opportunities exist for leveraging this behavior to identify and disrupt competing malware campaigns during incident response and threat hunting operations?

Ready to level up your intelligence game?

Sign Up!

Executive Summary

TA-NATALSTATUS is a highly disciplined cryptojacking threat actor exploiting exposed Redis servers worldwide, with a significant escalation observed in 2025. The group uses legitimate Redis commands to gain root access, install miners, and establish persistence through malicious cron jobs, immutable file locks, and SSH backdoors. Advanced evasion techniques include rootkit-style binary hijacking (renaming ps, top, curl, wget), process cloaking, and command obfuscation, enabling the campaign to evade traditional detection and maintain long-term control.

The actor systematically scans for unauthenticated Redis instances (port 6379), disables security controls (SELinux, firewalls), and deploys network scanning tools (masscan, pnscan) for lateral movement. TA-NATALSTATUS actively terminates rival cryptojacking malware (e.g., Kinsing) to monopolize system resources, further complicating detection and remediation.

The campaign disproportionately impacts cloud infrastructure, critical infrastructure, technology, manufacturing, and media sectors, with exposure rates exceeding 30% in several major economies. No direct links to other APT groups have been identified, but the TTPs reflect a mature, evolving threat model.

Mitigation requires immediate hardening of Redis configurations (authentication, localhost binding, network segmentation), deployment of file integrity monitoring and EDR solutions, and regular security audits. Organizations should monitor for indicators such as renamed system binaries, unauthorized cron jobs, and immutable files, and develop incident response playbooks tailored to persistent cryptojacking threats. Continuous staff training and threat intelligence sharing are essential to address the systemic security gap and reduce dwell time.

The campaign’s evolution, aggressive anti-rival tactics, and global reach signal a sustained, high-impact threat to cloud and critical infrastructure, necessitating urgent, coordinated defensive action.

Research & Attribution

Historical Context

TA-NATALSTATUS is an advanced cryptojacking campaign active since 2020, escalating globally in 2025. It targets exposed Redis servers worldwide, exploiting misconfigurations to gain root access and install cryptocurrency miners. Unlike typical cryptojacking operations, TA-NATALSTATUS employs stealth, persistence, and resilience techniques such as rootkit-style binary hijacking, process cloaking, command obfuscation, and immutable file locks. The campaign aggressively eliminates rival malware to monopolize compromised systems. This reflects a systemic failure to secure Redis instances globally, creating a vast attack surface for automated exploitation.

Timeline

• 2020: Initial related cryptojacking campaigns involving exposed Redis instances reported by Trend Micro.
• 2020–2025: TA-NATALSTATUS evolved its tactics, techniques, and procedures (TTPs), adding stealth and persistence features.
• 2025: The campaign escalated globally, actively targeting Redis servers in the US, Europe, Russia, India, and other regions.

Origin

TA-NATALSTATUS is a threat actor or group specializing in cryptojacking via exploitation of misconfigured Redis servers. The actor uses legitimate Redis commands to gain root privileges by exploiting Redis instances running as root, enabling direct manipulation of system cron jobs for persistence. The campaign is identified and tracked primarily by CloudSEK, with its TTPs showing evolution from earlier multiplatform worms reported by Trend Micro.

Countries Targeted

1. United States - Over 17% of Redis servers exposed.
2. Germany - Approximately 33% of Redis servers exposed.
3. United Kingdom - Around 27% of Redis servers exposed.
4. Finland - About 41% of Redis servers exposed.
5. Russia - Approximately 39% of Redis servers exposed.

Sectors Targeted

1. Cloud Infrastructure - Exploitation of Redis servers for cryptojacking.
2. Critical Infrastructure - Indirectly impacted due to reliance on cloud services.
3. Technology - Targeted through compromised cloud and network infrastructure.
4. Manufacturing - Affected by related malware campaigns.
5. Media and Communications - Also targeted by associated malware.

Motivation

Financial gain through stealthy, persistent cryptocurrency mining. The actor aims to maintain long-term control over compromised servers to maximize mining revenue while evading detection and eliminating competing malware.

Attack Types

• Scanning for unauthenticated Redis servers on port 6379.
• Using legitimate Redis commands (CONFIG SET, SAVE) to write malicious cron jobs.
• Disabling security features like SELinux and firewalls.
• Hijacking system binaries (e.g., renaming ps and top) to hide mining processes.
• Renaming download tools (curl and wget) to evade detection.
• Installing scanning tools (masscan, pnscan) for lateral movement.
• Establishing persistence via immutable files (chattr +i) and SSH backdoors.
• Executing a "kill list" to terminate rival cryptojacking malware.

Recommendations, Actions, Suggested Pivots, Forecasts and Next Steps

(Subscribers Only)

Recommendations, Actions, and Next Steps

1. Immediately Harden and Monitor Redis Server Configurations

   • Enforce Redis authentication, bind Redis to localhost (bind 127.0.0.1), and restrict access using network segmentation and firewall rules. Deploy file integrity monitoring to detect hijacked or renamed binaries (e.g., ps, top, curl, wget) and monitor for suspicious cron jobs, especially those redirecting output to /dev/null. Regularly update and patch Redis and related infrastructure to address known vulnerabilities. CloudSEK notes, “the root cause of their success is a systemic, worldwide failure to properly secure Redis instances,” and TA-NATALSTATUS “employs rootkit-style binary swaps, process cloaking, command obfuscation, immutable file locks, and anti-rival ‘kill lists’” (CloudSEK).
   • This directly addresses TA-NATALSTATUS’s exploitation of misconfigured Redis servers and their use of legitimate commands for persistence and evasion, reducing the attack surface and improving detection of stealthy modifications.
   • Challenges include potential downtime during reconfiguration, the need for staff training on secure Redis management, and integration of monitoring tools with existing infrastructure.
   • Success metrics: Reduction in exposed Redis instances (as measured by external scans), detection of unauthorized file or binary changes, and absence of unauthorized cron jobs or mining processes.
   • MITRE ATT&CK IDs: T1046 (Network Service Scanning), T1059 (Command and Scripting Interpreter), T1546.001 (Event Triggered Execution: Cron), T1036 (Masquerading), T1070.004 (Indicator Removal on Host: File Deletion).

2. Deploy Proactive Threat Detection and Incident Response Playbooks

   • Implement endpoint detection and response (EDR) solutions capable of identifying rootkit-like behaviors, process cloaking, and persistence mechanisms such as immutable files (chattr +i) and SSH backdoors. Develop and rehearse incident response playbooks specifically for cryptojacking and persistent threats, including steps for containment, eradication, and system recovery. CloudSEK provides a practical scenario: “The script renames the legitimate ps binary to ps.original and replaces it with a malicious wrapper… The administrator’s primary tool for process visibility is now actively lying to them.”
   • This recommendation targets the advanced stealth and persistence TTPs of TA-NATALSTATUS, enabling faster detection and remediation of active compromises and reducing dwell time.
   • Considerations include the cost and complexity of EDR deployment, the need for regular playbook updates, and ensuring staff are trained to recognize and respond to cryptojacking indicators.
   • Success metrics: Mean time to detect (MTTD) and mean time to respond (MTTR) to cryptojacking incidents, number of successful incident response exercises, and reduction in unauthorized persistent artifacts.
   • MITRE ATT&CK IDs: T1055 (Process Injection), T1547 (Boot or Logon Autostart Execution), T1562 (Impair Defenses), T1027 (Obfuscated Files or Information).

3. Conduct Regular Security Audits, Staff Training, and Threat Intelligence Sharing

   • Schedule periodic security audits and vulnerability assessments focused on cloud and Redis infrastructure. Provide targeted training for IT and DevOps staff on secure configuration, monitoring, and incident response for Redis environments. Actively participate in threat intelligence sharing with industry peers and government partners to stay updated on evolving TTPs and mitigation strategies. As SentinelOne and Palo Alto Networks highlight, cryptojacking “can cost organizations and victims both direct and indirect losses” and “prolonged mining can lead to significant cost spikes, degraded SLAs, and potential customer impact” (SentinelOne, Palo Alto Networks).
   • This addresses the systemic failure to secure Redis instances and ensures continuous improvement in organizational security posture, while fostering collaboration to counter emerging threats.
   • Challenges include resource allocation for audits and training, maintaining up-to-date knowledge of threat actor TTPs, and ensuring actionable intelligence sharing.
   • Success metrics: Number of completed audits and remediated findings, staff training completion rates, and participation in threat intelligence exchanges.
   • MITRE ATT&CK IDs: T1592 (Gather Victim Host Information), T1589 (Gather Victim Identity Information), T1609 (Container Administration Command).

Suggested Pivots

1. Which specific persistence and evasion techniques employed by TA-NATALSTATUS—such as rootkit-style binary hijacking, immutable file locks, process cloaking, and command obfuscation—are most effective at evading current detection tools, and how can endpoint detection and response (EDR), security information and event management (SIEM), and file integrity monitoring systems be optimized to detect these behaviors in real time?

2. Given the high exposure rates of unauthenticated Redis servers in countries like Finland (41%), Russia (39%), Germany (33%), and the United States (17%), how can threat intelligence and vulnerability management programs prioritize defensive measures across these geographic regions and critical sectors (cloud infrastructure, critical infrastructure, technology, manufacturing, media) to reduce the attack surface exploited by TA-NATALSTATUS?

3. How does TA-NATALSTATUS’s aggressive elimination of rival cryptojacking malware (e.g., Kinsing, DDG) through its "kill list" impact the broader cryptojacking ecosystem, and what opportunities exist for leveraging this behavior to identify and disrupt competing malware campaigns during incident response and threat hunting operations?

Forecast

Short-Term Forecast (3-6 months)

TA-NATALSTATUS will maintain and likely intensify its global cryptojacking campaign targeting exposed, unauthenticated Redis servers, particularly in countries with high exposure rates such as Finland (41%), Russia (39%), Germany (33%), and the United States (17%). The actor’s use of legitimate Redis commands to gain root access, combined with advanced stealth techniques—rootkit-style binary hijacking, process cloaking, command obfuscation, and immutable file locks—will enable persistent, stealthy mining operations that evade traditional detection methods. The campaign’s aggressive elimination of rival malware (e.g., Kinsing) will consolidate control over compromised systems, complicating detection and remediation efforts.

Organizations in cloud infrastructure, critical infrastructure, technology, manufacturing, and media sectors should prioritize immediate hardening of Redis configurations by enforcing authentication, binding Redis to localhost, and restricting network access via segmentation and firewall rules. Deployment of file integrity monitoring to detect renamed or hijacked binaries and monitoring for suspicious cron jobs redirecting output to /dev/null will be critical. Endpoint Detection and Response (EDR) solutions capable of identifying rootkit-like behaviors and persistence mechanisms will be essential to reduce dwell time and improve incident response.

Examples

• The 2025 escalation of TA-NATALSTATUS’s campaign globally, with documented stealth and persistence techniques, parallels earlier cryptojacking campaigns that evolved from opportunistic exploitation to sophisticated rootkit-style operations.
• Similar cryptojacking campaigns exploiting cloud misconfigurations (e.g., TeamTNT, Kinsing) have demonstrated the operational impact of persistent mining on cloud infrastructure performance and costs.
• The use of legitimate system tools and commands for persistence and evasion is consistent with advanced persistent threat (APT) tactics that complicate detection and response.

What to Watch Out For

• Increased scanning activity on port 6379 targeting Redis servers, especially from IPs linked to TA-NATALSTATUS.
• Detection of renamed system binaries (e.g., ps.original, top.original) or malicious wrappers replacing legitimate tools.
• Presence of immutable files (chattr +i) and unauthorized cron jobs redirecting output to /dev/null.
• Sudden reduction in activity from rival cryptojacking malware families, indicating TA-NATALSTATUS’s dominance.
• Reports of unexplained resource consumption or degraded cloud service performance in targeted sectors.

Long-Term Forecast (12-24 months)

TA-NATALSTATUS is expected to further evolve its cryptojacking campaign by enhancing evasion, persistence, and lateral movement capabilities. The actor may develop new rootkit variants and obfuscation methods to bypass emerging detection technologies, including advanced EDR, SIEM, and cloud-native security tools. Given the systemic failure to secure Redis instances globally, the campaign will remain a persistent threat to cloud infrastructure integrity, indirectly impacting critical infrastructure, manufacturing, and media sectors.

The campaign’s aggressive elimination of rival malware may lead to consolidation within the cryptojacking ecosystem, increasing TA-NATALSTATUS’s operational scale and profitability. This behavior presents opportunities for defenders to leverage threat hunting and incident response to disrupt the campaign. Over time, regulatory and industry initiatives—drawing on historical precedents such as PCI DSS and GDPR—may drive improved security standards for Redis and cloud services, though adoption will likely be uneven, prolonging the vulnerability window.

Examples

• Historical cryptojacking campaigns have evolved from opportunistic to highly persistent, stealthy operations with rootkit capabilities, similar to TA-NATALSTATUS’s trajectory.
• Consolidation of malware families through aggressive elimination tactics has been observed in other cybercrime ecosystems, such as banking trojans and ransomware gangs, leading to dominant actors controlling large attack surfaces.
• Past regulatory and industry efforts (e.g., PCI DSS, GDPR) have gradually improved security postures but required sustained enforcement and compliance efforts.

What to Watch Out For

• Emergence of new rootkit or obfuscation techniques in cryptojacking malware targeting Redis or similar cloud services.
• Increased use of lateral movement tools and network scanning utilities (e.g., masscan, pnscan) to expand campaign reach.
• Disappearance or significant reduction of rival cryptojacking malware families.
• Adoption of stricter Redis security configurations and cloud provider policies reducing exposed instances.
• Announcements of regulatory or industry initiatives targeting cloud service security and cryptojacking mitigation.

MITRE ATT&CK IDs

T1036 (Masquerading), T1546.001 (Event Triggered Execution: Cron), T1046 (Network Service Scanning), T1059 (Command and Scripting Interpreter), T1070.004 (Indicator Removal on Host: File Deletion), T1562 (Impair Defenses), T1055 (Process Injection), T1547 (Boot or Logon Autostart Execution), T1027 (Obfuscated Files or Information), T1070 (Indicator Removal on Host), T1592 (Gather Victim Host Information), T1589 (Gather Victim Identity Information), T1609 (Container Administration Command), S0346 (masscan), S0598 (Kinsing), S0599 (pnscan)

Appendix

References

1. (2025-08-21) - The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
2. (2025-08-22) - Redis Servers Targeted in Sophisticated Cryptojacking Attack to Deploy Miners and Bypass Security | Cyber Press
3. (2025-08-23) - GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets | The Hacker News
4. (2025-06-01) - How to Prevent Cryptojacking? | SentinelOne
5. (2025) - What Is Cryptojacking? | Palo Alto Networks

AlphaHunt

(Have feedback? Did something resonate with you? Did something annoy you? Just hit reply! :))

Tired of writing intellingence reports? Not sure if you should trust your AI generated report?

• write a report on ‘TA-NATALSTATUS Cryptojacking Campaign’

Does it take a chunks out of your day? Would you like help with the research?

This baseline report was thoughtfully researched and took 10 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst.

We just did the initial grunt work..

Are you ready to level up your skillset? Get Started Here!

Did this help you? Forward it to a friend!

(c) 2025 CSIRT Gadgets, LLC

MITRE ATTACK

Techniques

1. [T1036] Masquerading - TA-NATALSTATUS hijacks and renames system binaries such as ps, top, curl, and wget to evade detection and filter out their mining processes from standard administrative tools. This rootkit-style binary hijacking is a core stealth technique, as documented in CloudSEK’s technical analysis and confirmed by incident reports.

   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Enterprise Techniques - MITRE ATT&CK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

2. [T1546.001] Event Triggered Execution: Cron - The campaign uses legitimate Redis commands (CONFIG SET, SAVE) to write malicious cron jobs, ensuring persistence by scheduling mining payloads and defense evasion scripts.

   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Event Triggered Execution: Cron - MITRE ATT&CK
   • New Cryptojacking Attack Exploits Redis Servers | Cybersecurity News

3. [T1046] Network Service Scanning - TA-NATALSTATUS uses automated tools to scan for exposed Redis servers on port 6379, identifying vulnerable targets for exploitation and lateral movement.

   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press
   • Network Service Scanning - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK

Tactics

1. [TA0001] Initial Access - Exploiting unauthenticated, misconfigured Redis servers to gain root access without traditional privilege escalation.

   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Initial Access - MITRE ATT&CK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

2. [TA0003] Persistence - Achieved through cron job installation, immutable file locks (chattr +i), and SSH backdoors, ensuring long-term control over compromised systems.

   • Event Triggered Execution: Cron - MITRE ATT&CK
   • Persistence - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK

3. [TA0005] Defense Evasion - Disabling SELinux, firewalls, and using process cloaking and command obfuscation to avoid detection and maintain mining operations.

   • Defense Evasion - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

Procedures

1. [T1059] Command and Scripting Interpreter - TA-NATALSTATUS executes shell scripts via Redis to disable security controls, deploy miners, and automate persistence.

   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Command and Scripting Interpreter - MITRE ATT&CK
   • New Cryptojacking Attack Exploits Redis Servers | Cybersecurity News

2. [T1070.004] Indicator Removal on Host: File Deletion - The campaign deletes logs and temporary files to hinder detection and incident response.

   • Indicator Removal on Host: File Deletion - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

3. [T1562] Impair Defenses - Disabling SELinux, firewalls, and other host-based security controls to ensure uninterrupted mining.

   • Impair Defenses - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

Software

1. [S0346] masscan - Used by TA-NATALSTATUS to scan for additional vulnerable Redis servers, facilitating lateral movement and campaign expansion.

   • masscan - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

2. [S0598] Kinsing - A rival cryptojacking malware that TA-NATALSTATUS actively terminates using a “kill list” to monopolize system resources.

   • Kinsing - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime | The Hacker News

3. [S0599] pnscan - Deployed for network scanning to identify additional exploitable services and expand the campaign’s reach.

   • pnscan - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press

Mitigations

1. [M1030] Network Segmentation - Restricting Redis access to trusted networks and enforcing firewall rules has proven effective in reducing the attack surface, as recommended by CloudSEK and industry best practices.

   • Network Segmentation - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • How to Prevent Cryptojacking? | SentinelOne

2. [M1047] Audit - Regular auditing and monitoring for unauthorized changes to binaries, cron jobs, and system configurations have enabled organizations to detect and remediate TA-NATALSTATUS intrusions.

   • Audit - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • What Is Cryptojacking? | Palo Alto Networks

3. [M1026] Privileged Account Management - Ensuring Redis does not run as root and enforcing least privilege reduces the impact of exploitation, as highlighted in technical advisories and incident response playbooks.

   • Privileged Account Management - MITRE ATT&CK
   • The Ghost in the Machine: The Complete Dossier on TA-NATALSTATUS and the Cryptojacking Turf War | CloudSEK
   • Redis Servers Targeted in Sophisticated Cryptojacking Attack | Cyber Press