LSN โ€” Local Sovereign Network

Try Them All: RedTail and the Discipline of Covering Every Architecture

The Broad Sweep โ€” a deep read from the honeypot census

Classification: HIGH ยท Confidence: HIGH (first-party loader and payload analysis)

The honeypot's operator census sorted its adversaries onto three axes. The Go toolkit dissected across four earlier letters is depth: one architecture, compiled, modular, maintained, mastered. The Outlaw skeleton key is minimalism: no binary at all, a single line appended to a trust store. This letter is the third axis โ€” breadth โ€” and its clearest emblem is a single loop hidden in a dropper. When RedTail's loader lands on a machine whose processor it cannot identify, it does not guess, and it does not give up. It runs a binary compiled for every architecture it carries, one after another, until one of them executes. It would rather waste four failed launches than miss a single host.

That loop is the whole philosophy in miniature. The toolkit's author asked, which architecture is worth mastering? and answered x86-64, because the servers worth mining and the credentials worth stealing run on it. The Outlaw operator asked what architecture do I need? and answered none โ€” a public key runs on the victim's own daemon. RedTail asks neither question. It refuses to choose. It covers everything, and where coverage runs out, it substitutes brute force. This is not the crude end of a sophistication scale. It is a different, disciplined, and โ€” as the two waves the honeypot captured prove โ€” actively maintained bet about where victims live.

Two waves, ten days, a visible upgrade

DOCUMENTED, first-party: the sensor retained eleven RedTail samples in exactly two dated bursts, and nothing in between.

The first wave, 2026-07-09, was five files: four ELF miners โ€” for x86, x86-64, ARM, and AArch64 โ€” and one shell loader of 1,951 bytes. The second wave, 2026-07-19, was six files: the same four architectures, plus a RISC-V build, and a shell loader grown to 2,151 bytes. Each file arrived once, from one source address โ€” the signature of a burst delivery rather than a standing presence, which (as the census established) means these two observed waves are a sample of RedTail's cadence, not a measurement of it. Ten days separate them. What changed in those ten days is the interesting part, because it is small, deliberate, and unmistakably the work of someone maintaining a codebase.

Two things changed. RISC-V was added โ€” not merely as a fifth compiled binary, but woven into the loader's logic in two places. And the loader's method for defeating a specific hardening measure was upgraded. Everything else is byte-stable. This is not a rewrite; it is a point release. RedTail, like the toolkit and unlike the decade-frozen Outlaw key, is software under active development, and the honeypot caught two of its releases ten days apart.

The loader, dissected

The shell loader is where RedTail's strategy is legible, because the ELF binaries are just XMRig and the loader is the operator's own logic. It is a compact, careful piece of work.

It names its file randomly, but names itself in plain sight. The loader opens with get_random_string(), which draws a random length and fills it from openssl rand, falling back to /dev/urandom, falling back to the shell's $RANDOM, and โ€” if all of those fail โ€” falling back to the literal string redtail. The dropped binary is written to a hidden file named . followed by that random string, so the running artifact has an unpredictable name on disk. And yet the staging files it copies are named redtail.x86_64, redtail.arm8, and so on, and the last-ditch fallback name is the family's own name. RedTail hides the file and advertises the identity. It does not care that you know what it is; it cares that you cannot easily find the process or write a filename signature for it.

It detects the architecture, then refuses to trust the detection. The loader runs uname -mp and maps the result: x86_64/amd64 to x86_64, i[3456]86 to i686, armv8/aarch64 to arm8, armv7 to arm7, and โ€” in the second wave only โ€” riscv to riscv. But detection is only the fast path. If the architecture is unrecognized, a flag named NOARCH is set, and the loader enters the loop that defines it:

if [ $NOARCH = true ]; then
  for a in x86_64 i686 arm8 arm7 riscv; do
    cat redtail.$a >$FILENAME
    ./$FILENAME ssh
  done

It writes each architecture's binary in turn and tries to execute it. Most will fail โ€” an ARM binary will not run on x86 โ€” but one will succeed, and RedTail does not need to know which in advance. This is breadth as an algorithm: when knowledge runs out, substitute exhaustive attempts. The first wave's version of this loop iterated x86_64 i686 arm8 arm7; the second wave's added riscv to the end. The RISC-V expansion is present in both the detection branch and the brute-force list โ€” the mark of a change made properly, in every place it belongs, not patched in one spot and forgotten in another.

It treats noexec as a solvable problem. A common hardening step is to mount /tmp, /var/tmp, and /dev/shm with the noexec flag, so that malware which lands there cannot run. RedTail's loader explicitly defeats this. It enumerates the system's noexec mounts and builds an exclusion list, then searches the filesystem for a directory that is owned by the current user and carries rwx, skipping every noexec path. For each candidate โ€” including the usual /tmp, /var/tmp, /dev/shm as fallbacks โ€” it does not assume the directory will work. It writes a small test file, writes a 2-megabyte second test file (via dd or truncate), and only commits to a directory it has proven it can both write to and fill. This is the breadth operator's answer to defense-in-depth: do not assume a place to run exists; find one and verify it.

And here is the second ten-day change. The first wave enumerated noexec mounts with cat /proc/mounts | grep 'noexec' | awk '{print $2}'. The second wave replaced that with a dedicated function preferring findmnt -rn -O noexec -o TARGET, with the /proc/mounts parse retained only as a fallback. A more robust, more portable way to find the same mounts โ€” the kind of small correctness improvement a developer makes when they are still working on the code. The operator hardened their anti-hardening.

It tags its delivery vector. Every execution invokes the binary as ./$FILENAME ssh. The ssh argument tells the miner how it arrived โ€” brute-forced in over SSH, which is exactly how it reached this SSH honeypot. RedTail is labelling its own propagation channel, campaign telemetry baked into the launch.

It cleans up. After execution, the loader removes the staging files, the random-named binary, and any redtail.* copies it scattered, in both the working directory and wherever it staged. It leaves the miner running and the evidence gone.

Breadth is a bet, not a deficiency

It is tempting to read a loader that brute-forces every architecture as unsophisticated โ€” a shotgun where the toolkit is a rifle. That reading is wrong, and the census is the reason.

The toolkit ships one architecture because it has chosen its prey: servers, which are x86-64, and which are worth the depth of a maintained modular platform. Its author spends engineering to buy depth on a narrow target. RedTail ships five architectures โ€” and carries roughly twenty-five megabytes of redundant binary to do it โ€” because it has chosen a different prey: everything. Routers, IoT devices, network appliances, single-board computers, and the odd RISC-V board, the vast unhardened population that runs on ARM and MIPS and now RISC-V rather than on Xeons. Its author spends bytes to buy coverage across a wide target. Neither is spending carelessly. They are buying different things.

The proof that RedTail's breadth is deliberate rather than lazy is the very care in the loader โ€” the noexec verification, the test-file executability proof, the two-place RISC-V integration, the delivery tagging, the cleanup. A lazy operator writes to /tmp and hopes. RedTail writes to /tmp only after proving it can, and only after checking that /tmp is not one of the noexec mounts it specifically hunts for. Breadth and care are not opposites. The breadth operator has simply pointed its care at a different problem: not how deep can I go on one target but how do I reliably run on any target at all.

The RISC-V tell

The single most revealing detail in the ten-day diff is which architecture was added, because RISC-V is not yet where the victims are.

RISC-V is an emerging architecture. Its installed base of internet-exposed, unhardened, brute-forceable devices in mid-2026 is a rounding error next to ARM and x86. An operator optimizing for this quarter's yield would not spend a build target on it. RedTail did. And that is the tell: RedTail is provisioning for victims that barely exist yet, extending its coverage ahead of the device population rather than in response to it. It is a forward bet on where the unhardened frontier is moving โ€” the same instinct that made Mirai-lineage botnets cover obscure architectures years before anyone counted the yield. The breadth operator does not just cover the present target surface. It positions for the future one, ten days at a time.

This reframes the maintenance finding. The toolkit's release cadence served depth โ€” new capabilities on its one architecture. RedTail's release cadence serves breadth โ€” new architectures on its one capability. Both are maintained software with visible iteration; they simply iterate along different axes. The census called them opposite strategies. The maintenance patterns show them to be opposite strategies pursued with the same professional discipline.

The payload: XMRig, and the same missing wallet

The eleven binaries reduce to one payload. Every ELF is XMRig โ€” the strings are unambiguous: cryptonight-monerov7, cryptonight-monerov8, the XMRIG_VERSION and XMRIG_HOME_DIR build constants, stratum+ssl:// and stratum+tcp://, donate-level and donate-over-proxy, and the built-in donation domains donate.ssl.xmrig.com, donate.v2.xmrig.com, and nicehash.com. RedTail's monetization is Monero mining, delivered by the loader's ssh propagation, on whatever architecture the victim turns out to be.

But the operator's pool and wallet are not in the binary. The only network indicators the miner carries are XMRig's own defaults, and the telling string is present in both waves: no valid configuration found, try https://xmrig.com/wizard. The shipped artifact carries the miner's factory settings and nothing of the operator's โ€” no pool address, no wallet, no worker identity. The mining configuration is externalized, supplied at runtime rather than compiled in.

That is precisely the pattern the toolkit investigation named "Two Miners, No Wallet." Two operators as different as any two on the sensor โ€” one deep and narrow, one broad and shallow โ€” converge on the identical operational-security decision: never ship the wallet. Whatever separates the depth strategy from the breadth strategy, it is not professionalism about the one artifact that would burn the operation if it leaked. Externalized secrets are the shared baseline of the honeypot's serious miners. The wallet is the one thing worth the cost of externalizing, and both the rifle and the shotgun pay it.

The shape of a sweep

The delivery topology is as distinctive as the loader. Every one of the eleven samples arrived exactly once, from exactly one source address, clustered into two single-day bursts. Set that against the sensor's standing presences: the toolkit drips continuously across four months from a scatter of addresses; the Outlaw key rains from a hundred hands over the whole window. RedTail does neither. It appears all at once, delivers its full architecture set to the host it landed on, and vanishes for ten days.

That shape is what a sweep looks like from a single sensor's vantage. A breadth operator scanning a range does not linger; it brute-forces a host, drops the complete payload set so that whatever the host turns out to be will run something, tags the delivery, cleans up, and moves to the next address. The honeypot is one address in that range, so it sees one delivery per sweep and nothing between sweeps. The two waves are not RedTail's cadence โ€” they are the two occasions the sensor's single IP fell inside a sweep's path. This is why the census insisted its fourteen-percent corpus share is a floor: a standing presence is measured by any day's telemetry, but a sweep is caught only on the day it crosses you, and a sensor sees a vanishing fraction of the sweeps that never do.

It also explains the loader's insistence on running something immediately. A standing operator can afford to persist and retry; a sweep gets one pass at each host and must convert it on contact. The NOARCH try-every-binary loop, the noexec verification, the immediate ./<file> ssh launch โ€” the whole loader is built to guarantee execution on first and only contact, because for a sweep there is no second visit. Breadth on the target axis forces urgency on the time axis: cover every architecture, because you only get one shot at each machine, and you will never know in advance what it runs.

Three philosophies, one board

With RedTail dissected, the census's triptych is complete, and it holds together better than a tidy taxonomy has any right to.

Depth is the toolkit: one architecture, one author's compounded craft, maintained for capability. Minimalism is the Outlaw key: no architecture, no binary, a single line that borrows the victim's own daemon. Breadth is RedTail: every architecture, plus brute force where coverage ends, maintained for reach. Three operators, three answers to the same question of how to run on strangers' machines at scale, and each answer internally coherent down to its smallest design choice.

Two convergences make the triptych more than a filing system. First, on secrets: the depth operator and the breadth operator, opposite in almost everything, both externalize their wallets โ€” professionalism about the crown jewel is independent of strategy. Second, on maintenance: the two operators that ship binaries โ€” toolkit and RedTail โ€” are both actively iterating software with release cadences, while the operator that ships no binary is a decade-frozen constant. Maintenance tracks payload complexity, not reach. The most-reaching artifact on the sensor (the Outlaw key, by distinct IPs) has not changed in years; the two that require compilation are revised in real time. Reach does not demand upkeep. Capability does.

Defense: the method outlives the binaries

RedTail is the census's hardest operator to signature by its files, precisely because breadth makes the files a moving target. Eleven binaries, five architectures, recompiled between waves ten days apart โ€” an arch-by-arch hash blocklist is stale before it is deployed, and the next wave will add a sixth architecture or a seventh. Chasing the binaries is chasing the part of RedTail designed to multiply.

The durable signature is the loader's method, which barely changed across the very ten days in which the binaries did:

These are behaviors, not bytes, and they persisted while the bytes churned. It is the same lesson the two preceding deep-reads reached from opposite directions: the Outlaw key taught that the widest campaign leaves no binary to scan and must be caught at the file it writes; RedTail teaches that the broadest campaign multiplies its binaries faster than any blocklist and must be caught at the method they share. Depth, minimalism, and breadth defeat byte-signatures in three different ways, and all three surrender to watching behavior instead.

Bounds and limits

DOCUMENTED, first-party: the eleven samples, their architectures and sizes, the two dated waves, the full loader logic of both waves, the ten-day diff (RISC-V added to detection and to the brute-force loop; noexec enumeration upgraded from a /proc/mounts parse to findmnt), and the XMRig payload strings including the absent operator configuration.

INFERRED, high confidence: that the two waves are one maintained operator's successive releases (the byte-stable loader with two coherent, correctly-integrated changes is a point release, not two independent authors); that the missing pool and wallet are externalized rather than absent (the miner is functional XMRig carrying only factory defaults). Attribution to the publicly-reported RedTail family rests on the family label, the self-naming loader, and the XMRig payload, consistent with that reporting.

BOUNDED: two waves at one sensor are a sample of a burst operator, so RedTail's true cadence, architecture set, and reach are all lower bounds โ€” the census established that burst deliveries are sampled, not measured, and RedTail's fourteen-percent corpus share could be much higher on a longer or wider clock. The operator's monetization endpoint โ€” the pool that would reveal the wallet and the scale โ€” was not captured, because the artifact does not carry it. The observed ten-day diff is the evolution the sensor happened to see between two drops; it is not a claim that nothing else changed. And "every architecture" means every architecture RedTail chose to ship, which as of the second wave is five, and as of the next wave the honeypot did not see is very likely more.

None of these bounds move the shape of the result. RedTail ships for every processor it can, brute-forces the ones it cannot name, verifies a place to run in defiance of noexec, tags how it arrived, cleans up after itself, externalizes its wallet, and โ€” ten days apart โ€” was still being improved. The toolkit chose one architecture and mastered it. The Outlaw key chose none. RedTail chose all of them, and when it met a processor it could not name, it tried every binary it owned rather than miss one host. That is not the crude option. It is breadth, engineered.

This letter follows from the full-corpus operator census (The Toolkit, Part Four), which identified RedTail as the corpus's breadth exemplar and its third-largest presence. With the Go toolkit (depth) and the Outlaw skeleton key (minimalism) already dissected, this completes the three strategies the census named โ€” and finds that two of the three are maintained software still shipping, ten days at a time.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Broad Sweep โ€” 1 / 4 Next โ†’