libredtail-http in Your Access Log: The RedTail Cryptominer Attacks

libredtail-http

What it is

libredtail-http is the User-Agent header of RedTail cryptominer attacks over HTTP. A SANS Internet Storm Center guest diary found it to be the most common user agent on the author’s DShield honeypot, sent from 113 different addresses, and describes the attack in detail. Each run begins with four POST requests. The first two attempt directory traversal toward /bin/sh, one of them URL-encoded, looking for CGI misconfigurations that allow command execution, with a command that downloads a shell script through wget or curl. The next two exploit CVE-2024-4577, a flaw in older PHP versions whose “Best-Fit” character replacement misinterprets characters as PHP options: the request sets allow_url_include=1 and auto_prepend_file=php://input, so PHP runs the body of the request as code. After that the attack probes PHP installation paths for PHPUnit.

According to SANS, the script the attack runs (cve_2024_4577.selfrep) finds out the system’s architecture, finds directories it can write to, looks for cron jobs of other cryptominers and stops their services, and installs a RedTail binary named .redtail, a hidden file, in x86_64, i686, aarch64 or arm7 builds. SANS notes that RedTail cryptominers have been around since 2023 and that libredtail-http and CVE-2024-4577 started appearing in mid 2024.

On our own server, libredtail-http was among the busiest user agents of the last 30 days (counts above). The paths it requested most were /index.php, /hello.world and /, and PHPUnit’s eval-stdin.php under at least five vendor paths. / and each of those eval-stdin.php paths were requested exactly the same number of times, as you would expect from one fixed sequence of requests repeated on every run.

Who sends it

Bots, from many unrelated machines. SANS saw 113 addresses on one honeypot and judged them likely to be bots, two of them probably running the same script; on our server the requests came from several dozen addresses in a month. There is no company behind the header and no opt-out.

Is it a threat?

Yes: it is an exploitation attempt, not research (MITRE ATT&CK T1190, exploit public-facing application). The servers at risk are those running a vulnerable PHP-CGI setup or an old PHPUnit inside the web root. A successful exploit ends with the server mining cryptocurrency for someone else (T1496, resource hijacking). For any other server the requests are noise, but noise worth blocking, since nothing legitimate sends this header.

How to handle it

1. Search the access log for the user agent and look at the status codes. 404 and 403 mean the probes found nothing.
2. Any 200 to one of its requests for a PHP script or an eval-stdin.php path means an exploit may have run: look for a .redtail file, new cron jobs, unknown processes and unexpected CPU load.
3. Patch PHP, never expose PHP-CGI directly, and remove PHPUnit and other development tools from production web roots.
4. Refuse the user agent at the edge.

Find its requests, and any that did not end in an error:

grep 'libredtail-http' /var/log/nginx/access.log | awk '{print $9}' | sort | uniq -c
grep 'libredtail-http' /var/log/nginx/access.log | awk '$9 < 400'

Refuse it in nginx (server block):

if ($http_user_agent ~* "^libredtail-http") {
    return 403;
}

The free log analyzer groups these requests by source in an access log and flags any probe that got a 200 back; the IP blocklist checker shows which free blocklists already list the addresses.