Exposed Redis: Unauthenticated RCE to Cryptominer

A Redis caching server with no password set accidentally has its port 6379 reachable from the internet. Minutes later, an attacker uses built-in Redis commands to overwrite the root crontab, drop a cryptominer, and open a persistent stratum connection. Walk the Redis logs, the audit trail, and the firewall egress step by step.