Cloud Malware Campaigns Hijack Exposed Redis and Kubernetes for Botnets and Credential Theft

Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the P2PInfect botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the SLAVEOF command and, in some cases, leveraging CVE-2022-0543 for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads.

Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled TeamPCP as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, PCPJack, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.