Malware2026

RedTail Cryptominer

1Rules

3References

1Folders

2026-04-30Latest

Summary

RedTail Cryptominer is tracked here as a malware family or toolset with 1 Sigma detection spanning 2026. Coverage centers on webserver.

Related Detections

Search this threat

Emerging Threatmediumexperimental

RedTail Cryptominer User-Agent

Detects inbound web requests using the "libredtail-http" User-Agent. libredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026. It is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.

Web Server Log

TA0001 · Initial AccessT1190 · Exploit Public-Facing Applicationdetection.emerging-threats

Marco Pedrinazzi (InTheCyber)Thu Apr 302026

References