https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/redtail-cryptominer/ Recent content in RedTail-Cryptominer on Detection.FYI Hugo -- gohugo.io Wed, 01 Jul 2026 11:32:55 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/redtail-cryptominer/web_malware_redtail_useragent/ Wed, 01 Jul 2026 11:32:55 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/malware/redtail-cryptominer/web_malware_redtail_useragent/ Detects inbound web requests using the "libredtail-http" User-Agent. libredtail-http is a unique User-Agent string associated with a campaign of automated, malicious scans and attacks targeting exposed container environments and web applications,notably identified in activities stemming from late 2024 through early 2026. It is primarily used by the RedTail cryptominer malware to identify and exploit vulnerabilities for deploying cryptocurrency miners.