TF-MAL-elf.headcrab

Description

ThreatFox malware family `elf.headcrab`. Printable name: HeadCrab.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• State-of-the-Art Redis Malware Bypasses Security Solutions
  web:gbhackers.com

  HeadCrab poses a significant threat, having infiltrated over 1,200 servers. Immediate remediation is imperative for infected systems, involving thorough incident response, isolation, and cleanup.

  2026-05-22 02:08 UTC
• New HeadCrab Malware Hijacks 1,200 Redis Servers - Heimdal Security
  web:heimdalsecurity.com

  Since September 2021, over a thousand vulnerable Redis servers online have been infected by a stealthy malware dubbed " HeadCrab ", designed to build a botnet that mines Monero cryptocurrency.

  2026-05-22 02:08 UTC
• PDF REDIScovering HeadCrab
  web:i.blackhat.com

  HeadCrab A Technical Analysis of a Novel Malware and the Mind Behind It

  2026-05-22 02:08 UTC
• HeadCrab (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the HeadCrab malware family including references, samples and yara signatures.

  2026-05-22 02:08 UTC
• REDIScovering HeadCrab - A Technical Analysis of a Novel Malware and ...
  web:webinars.cloudnativenow.com

  HeadCrab is a highly elusive and sophisticated malware created by an advanced threat actor who utilized custom-made Redis Modules and APIs to build a full-scale malicious framework. Since 2021, the highly advanced malware has deployed several highly technical novel techniques which allowed it to infiltrate servers worldwide.

  2026-05-22 02:08 UTC
• HeadCrab: A Novel State-of-the-Art Redis Malware - Aqua
  web:www.aquasec.com

  Aqua Nautilus researchers discovered a new elusive and severe threat that has been infiltrating and residing on servers worldwide since early September 2021. Known as HeadCrab , this advanced threat actor utilizes a state-of-the-art, custom-made malware that is undetectable by agentless and traditional anti-virus solutions to compromise a large number of Redis servers. The HeadCrab botnet has ...

  2026-05-22 02:08 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 02:08 UTC
• HeadCrab 2.0 Goes Fileless, Targeting Redis Servers for Crypto Mining
  web:www.cyberaffairs.com

  Describing HeadCrab 2.0 as an escalation in the sophistication of Redis malware , Aqua said its ability to masquerade its malicious activities under the guise of legitimate commands poses new problems for detection.

  2026-05-22 02:08 UTC
• 'HeadCrab' Malware Variants Commandeer Thousands of Servers
  web:www.darkreading.com

  'HeadCrab' Malware Variants Commandeer Thousands of Servers New techniques in a second variant of the malware improved functionality and communication commands.

  2026-05-22 02:08 UTC
• Stealthy HeadCrab malware compromised 1,200 Redis servers worldwide
  web:www.scworld.com

  At least 1,200 Redis database servers worldwide have been compromised by a sophisticated piece of malware since September 2021, while more than 2,800 uninfected servers remain at high risk of exploitation. Discovered by Asaf Eitnai and Nitzan Yaakov, the Aqua Nautilus security researchers posted on the company's blog that the malware , which they're calling " HeadCrab ," was meticulously ...

  2026-05-22 02:08 UTC

Only Available for Registered Users. Sign in to view.