Loading malware…
P2PInfect is a Rust-based, cross-platform peer-to-peer worm and decentralized botnet active since at least 2023. It primarily compromises exposed or vulnerable Redis deployments, including through Redis replication abuse and CVE-2022-0543, then enrolls infected systems into a resilient P2P mesh that distributes updates and additional payloads without depending on centralized command-and-control infrastructure. Variants also scan for SSH services and conduct SSH password-brute-force activity to propagate.
P2PInfect targets Linux and Windows systems and has been observed in x86-64, ARM, and MIPS builds. It has affected internet-exposed Redis servers and cloud environments including Kubernetes clusters. The malware supports network scanning, P2P propagation, encrypted peer communications, payload delivery, anti-debugging and anti-forensic measures, self-updating behavior, and cryptocurrency mining. Some operations have maintained dormant infections for extended periods; P2PInfect infrastructure has also been associated with delivery of cryptominers and ransomware. Observed defense evasion includes packed binaries, wrapper executables, disabling core dumps, runtime modification of auxiliary components, firewall manipulation on Windows, and deletion of initial droppers. No definitive public attribution to a specific threat actor is established.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
Then ... the script opens a communication port for the threat actor to access the compromised instance. This is a form of persistence, allowing the threat actors to maintain access to the infected host and keep it operable.
“P2PInfect activity targeting internet-exposed and exploiting misconfigured Redis instances... The campaign exploits CVE-2022-0543.”
“uses mechanisms such as cron jobs and SSH authorized keys for persistence.”
To infect new targets, P2PInfect executes a bruteforce attack against the device with the SSH server and, after a successful login, different commands are executed to download and run the malware.
“deploys ELF-based malware, establishes reverse shells.”
“attackers abusing Redis replication and module-loading capabilities to achieve remote code execution.”
The P2PInfect worm infects vulnerable Redis instances by exploiting the Lua sandbox escape vulnerability, CVE-2022-0543.
Attackers connect to the exposed service and issue the SLAVEOF command, turning the legitimate Redis node into a follower of a malicious server under their control. This tricks the node into loading arbitrary modules from attacker infrastructure...
“uses mechanisms such as cron jobs and SSH authorized keys for persistence.”
“uses mechanisms such as cron jobs and SSH authorized keys for persistence.”
Then ... the script opens a communication port for the threat actor to access the compromised instance. This is a form of persistence, allowing the threat actors to maintain access to the infected host and keep it operable.
P2Pinfect has been observed in the wild abusing the SLAVEOF command to turn discovered open nodes into followers of the attacker’s server, thereby gaining code execution.
“uses mechanisms such as cron jobs and SSH authorized keys for persistence.”
RediShell (CVE-2025-49844) is a critical RCE that allows an authenticated user to bypass the Lua sandbox by sending a maliciously crafted script to manipulate the garbage collector, thereby granting native code execution.
“uses mechanisms such as cron jobs and SSH authorized keys for persistence.”
Some variants of the P2Pinfect clients also have usermode rootkit capabilities.
The PowerShell script leveraged the encode command to obfuscate the communication initiation.
Interestingly, the latest variants of this malware tend to utilize a particular version of the UPX packer: 4.0.2.
Finally, lots of main ELF payloads are distributed inside wrapper ELF files that just print a famous “Hello, World!” message pretending this is its only functionality.
The firewall rule is named Microsoft Sync.
“The Rust-based P2PInfect worm further supports ... anti-forensics.”
The Monitor is dumped to C:\Users\username\AppData\Local\Temp\cmd.exe.
Once a node was enrolled in the P2P mesh, it stayed relatively quiet, a behavior the researchers described as dormant. The bots appeared to be waiting, ready to receive tasks from operators at any time.
Attackers connect to the exposed service and issue the SLAVEOF command, turning the legitimate Redis node into a follower of a malicious server under their control. This tricks the node into loading arbitrary modules from attacker infrastructure...
In addition to disabling core dumps through the 'setrlimit' syscall and the process debugging protection noted by Cado Security
One of the first operations performed by the PowerShell command is to configure the local system firewall to block legitimate access to or from the compromised Redis application.
Once the device is infected it's ready to spread to other devices. To infect new targets, P2PInfect executes a bruteforce attack against the device with the SSH server and, after a successful login, different commands are executed to download and run the malware.
“The Rust-based P2PInfect worm further supports ... SSH brute force.”
P2Pinfect primarily spreads by exploiting Redis vulnerabilities and also includes a basic SSH password sprayer.
“The Rust-based P2PInfect worm further supports network scanning.”
The botnet used this network to distribute payloads, gather information about the infected environment, and maintain communication without relying on a centralized command server.
To find the memory to be modified inside the “template bash” executable to make it ready to be executed, P2PInfect looks for two markers “thisisport” and “password12345678” to dynamically replace them with two random values.
Once a node was enrolled in the P2P mesh, it stayed relatively quiet, a behavior the researchers described as dormant. The bots appeared to be waiting, ready to receive tasks from operators at any time.
In addition to disabling core dumps through the 'setrlimit' syscall and the process debugging protection noted by Cado Security
A version of this malware that utilizes SSH protocol for propagation was intercepted by our chain of globally distributed honeypots on November 6, 2023.
“The Rust-based P2PInfect worm further supports ... SSH brute force.”
The malware is capable of performing Peer-to-Peer (P2P) communications without relying on a single Command and Control server (C&C) to propagate attackers’ commands.
The malware is capable of performing Peer-to-Peer (P2P) communications without relying on a single Command and Control server (C&C) to propagate attackers’ commands.
P2Pinfect is a self-propagating malware strain that combines worm-like spreading capabilities with a decentralized botnet architecture. This peer-to-peer (P2P) architecture makes it highly resilient to sinkholing and infrastructure takedowns.
P2PInfect uses its P2P network to distribute follow-up malware to newly infected systems or cloud instances.
after a successful login, different commands are executed to download and run the malware
P2PInfect peers’ communication occurs over non-standard ports.
While our telemetry indicated that no second-stage payload was ever executed, this botnet has been observed in the wild to remain dormant for extended periods before delivering ransomware and crypto miners.
“The Rust-based P2PInfect worm further supports ... cryptocurrency mining.”
245 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.