What it is
RedTail is a cryptocurrency miner for Linux that mines Monero. It comes in separate builds for different processors, named redtail.arm7, redtail.arm8, redtail.i686 and redtail.x86_64. An install script called setup.sh copies the right build to a hidden file called .redtail and runs it, and a second script, clean.sh, removes rival miners. The attackers also add their own SSH key to root's authorized_keys file and lock that file so it is harder to edit.
How it gets in
Through weak root SSH passwords on servers open to the internet. Later reports also name web-facing software with known security holes that hasn't been updated.
Close the door: Disable direct root SSH login and password authentication in favour of keys, patch internet-facing software promptly, and block file-transfer ports you do not use; the cited diaries recommend disabling root logins, SSH keys, Fail2ban, TCP Wrappers and patching.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location (in a user's home folder) | ~/.ssh/authorized_keys |
| File name | redtail.arm7 |
| File name | redtail.arm8 |
| File name | redtail.i686 |
| File name | redtail.x86_64 |
| File name | .redtail |
| File name | setup.sh |
| File name | clean.sh |
| Process name | .redtail |
| SSH key | rsa-key-20230629 |
These commands only look. They change nothing.
Look in every user's home folder for the known files:
sudo ls -la /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name 'redtail.arm7' -o -name 'redtail.arm8' -o -name 'redtail.i686' -o -name 'redtail.x86_64' -o -name '.redtail' -o -name 'setup.sh' -o -name 'clean.sh' \) 2>/dev/nullLook for the known process names, and where each one runs from:
for p in $(pgrep -f '\.redtail'); do echo "$p $(sudo readlink /proc/$p/exe)"; doneList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Fingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: These signs come from a series of honeypot write-ups from 2024 to 2026, not proof of what it does today; the most-cited company report couldn't be read, so nothing from it is used. setup.sh and clean.sh are very common names, and the attackers deleted both after running them. .redtail is more specific but easy to change. The SSH sign is only a key label, rsa-key-20230629, not the key itself, and that style of label is what the PuTTY key tool adds by default, so real keys can carry it. Never delete a key because of its label: compare the whole key. One write-up says it runs crontab, but no exact scheduled task line was published. Builds differ from batch to batch, so the fingerprints identify the published samples only.
How to remove it by hand
Work through these in order. Don't skip the first two.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from, open connections, every crontab, and /root/.ssh/authorized_keys along with its file attributes (sudo lsattr /root/.ssh/authorized_keys).
- Find its processes by where they run from, not by name: for each suspect process number, run sudo readlink /proc/NUMBER/exe and fingerprint that file with sudo sha256sum. A program called .redtail, or one that matches a fingerprint above, is confirmed. Stop it with sudo kill NUMBER, and use kill -9 only if that doesn't work.
- Move .redtail and any redtail.* files the checks above find into a folder only root can read. Delete the originals once you've finished collecting evidence.
- In /root/.ssh/authorized_keys, and in each user's ~/.ssh/authorized_keys, keep a backup copy first. If lsattr shows the i or a flag, run sudo chattr -ia on the file so you can edit it. Delete only key lines you can confirm aren't yours by comparing the whole key text with your own keys. A line labelled rsa-key-20230629 may be a real key, so don't delete it on the label alone, and never delete the whole file.
- Go through every crontab line by line and remove only lines you can confirm aren't yours. No exact line was published, so check each one with its owner.
- The reported attacks ran as root, so the server's integrity is usually in doubt. If you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
- From a clean computer, change the root and other account passwords, SSH keys and service credentials that were on the server, and cancel the old ones.
- Before you reconnect: turn off direct root logins over SSH, switch to key logins instead of passwords, install all updates, and block file transfer ports you don't use. Then restart and run the checks above again.
What Minaki Scan does about it
Minaki Scan finds this threat by the fingerprints of its files and processes and removes it, but only after you type yes. It backs up what it changes and logs every change on your server.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- Analysis of 'redtail' File Uploads to ICS Honeypot, a Multi-Architecture Coin Miner [Guest Diary], SANS Internet Storm Center (2024-05-22)
- Examining Redtail Analyzing a Sophisticated Cryptomining Malware and its Advanced Tactics [Guest Diary], SANS Internet Storm Center (2025-01-09)
- Danger of Libredtail [Guest Diary], SANS Internet Storm Center (2026-04-29)
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)