P2PInfect

Then ... the script opens a communication port for the threat actor to access the compromised instance. This is a form of persistence, allowing the threat actors to maintain access to the infected host and keep it operable.

Some strains attempt to abuse SSH while others exploit vulnerabilities in Redis, a popular in-memory database, to spread rapidly across networks.

To infect new targets, P2PInfect executes a bruteforce attack against the device with the SSH server and, after a successful login, different commands are executed to download and run the malware.

This shell-based dropper retrieves a P2Pinfect client binary from http://8[.]210[.]50[.]65:60126/linux and writes it to /top/RarF51vUe0... It then executes the binary with a large base64-encoded argument blob.

The P2PInfect worm infects vulnerable Redis instances by exploiting the Lua sandbox escape vulnerability, CVE-2022-0543.

Then ... the script opens a communication port for the threat actor to access the compromised instance. This is a form of persistence, allowing the threat actors to maintain access to the infected host and keep it operable.

P2Pinfect has been observed in the wild abusing the SLAVEOF command to turn discovered open nodes into followers of the attacker’s server, thereby gaining code execution.

RediShell (CVE-2025-49844) is a critical RCE that allows an authenticated user to bypass the Lua sandbox by sending a maliciously crafted script to manipulate the garbage collector, thereby granting native code execution.

Some variants of the P2Pinfect clients also have usermode rootkit capabilities.

The PowerShell script leveraged the encode command to obfuscate the communication initiation.

Interestingly, the latest variants of this malware tend to utilize a particular version of the UPX packer: 4.0.2.

Finally, lots of main ELF payloads are distributed inside wrapper ELF files that just print a famous “Hello, World!” message pretending this is its only functionality.

The firewall rule is named Microsoft Sync.

In addition to disabling core dumps through the 'setrlimit' syscall

The Monitor is dumped to C:\Users\username\AppData\Local\Temp\cmd.exe.

In addition to disabling core dumps through the 'setrlimit' syscall and the process debugging protection noted by Cado Security

Once the device is infected it's ready to spread to other devices. To infect new targets, P2PInfect executes a bruteforce attack against the device with the SSH server and, after a successful login, different commands are executed to download and run the malware.

P2Pinfect primarily spreads by exploiting Redis vulnerabilities and also includes a basic SSH password sprayer.

Once the core P2PInfect sample finishes execution, the payload will start scanning for additional hosts to compromise. The scanning operation focuses on exposed Redis hosts. However, researchers also found that compromised Redis instances also perform scanning attempts over port 22, SSH.

To find the memory to be modified inside the “template bash” executable to make it ready to be executed, P2PInfect looks for two markers “thisisport” and “password12345678” to dynamically replace them with two random values.

In addition to disabling core dumps through the 'setrlimit' syscall and the process debugging protection noted by Cado Security

A version of this malware that utilizes SSH protocol for propagation was intercepted by our chain of globally distributed honeypots on November 6, 2023.

Several peer nodes were independently flagged for SSH and exploit attacks.

The malware is capable of performing Peer-to-Peer (P2P) communications without relying on a single Command and Control server (C&C) to propagate attackers’ commands.

The malware is capable of performing Peer-to-Peer (P2P) communications without relying on a single Command and Control server (C&C) to propagate attackers’ commands.

P2Pinfect is a self-propagating malware strain that combines worm-like spreading capabilities with a decentralized botnet architecture. This peer-to-peer (P2P) architecture makes it highly resilient to sinkholing and infrastructure takedowns.

P2PInfect uses its P2P network to distribute follow-up malware to newly infected systems or cloud instances.

after a successful login, different commands are executed to download and run the malware

P2PInfect peers’ communication occurs over non-standard ports.

While our telemetry indicated that no second-stage payload was ever executed, this botnet has been observed in the wild to remain dormant for extended periods before delivering ransomware and crypto miners.

The malware remains dormant for extended periods and has been observed hosting and deploying crypto miners and ransomware in the wild.

One of the first operations performed by the PowerShell command is to configure the local system firewall to block legitimate access to or from the compromised Redis application.