Loading story…
Researchers reported that the P2PInfect worm, a Rust-based cross-platform malware family, expanded beyond earlier x86-64 infections to target ARM and MIPS systems, increasing the threat to IoT and embedded Linux environments. The worm spreads through multiple paths, including exploitation of Redis weaknesses and SSH brute-force activity, and uses a peer-to-peer architecture rather than a centralized command-and-control server, making disruption more difficult.
Analysis of newer samples showed the malware also incorporates self-protection and evasion features, including anti-debugging checks, disabled core dumps, runtime modification of a dropped auxiliary binary, and wrapper ELF files used to conceal the main payload. Telemetry tied the campaign to growing infection activity from late 2023 into early 2024, with observed malicious connections frequently originating from China, Hong Kong, and Singapore, while published research also included detection content such as YARA rules, infrastructure indicators, and malware hashes to support defender response.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The report says observed P2PInfect SSH-propagation activity continued to grow through January 2024. Honeypot telemetry showed sustained infection attempts, with many malicious connections originating from China, Hong Kong, and Singapore.
On November 6, 2023, Nozomi Networks Labs honeypots intercepted a P2PInfect variant that propagated via SSH. This provided direct evidence of the worm using SSH abuse in addition to Redis exploitation.
Nozomi Networks Labs honeypots began recording initial P2PInfect infection commands in October 2023, marking observed activity tied to the worm's SSH-related propagation behavior.
The report states that the first known P2PInfect strains date back to at least July 2023. These early strains established the malware family before later expansion to additional architectures and propagation methods.
Embedded Windows DLL metadata found in P2PInfect samples indicated a compilation timestamp in May 2023, suggesting development activity may have begun before the malware's wider observed distribution.
Nozomi Networks Labs identified new P2PInfect samples targeting ARM architecture, expanding the malware's known reach beyond previously observed x86-64 and MIPS variants. The report states ARM targeting had not been reported by other researchers at the time.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 197 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported a self-replicating peer-to-peer worm dubbed **P2PInfect** that compromises exposed Redis servers by exploiting **`CVE-2022-0543`**, a critical Lua sandbox escape affecting Debian-packaged Redis deployments. The malware is written in **Rust**, targets both **Linux** and **Windows**, and was observed attacking Redis honeypots in Unit 42’s HoneyCloud environment. Researchers estimated that **934** internet-exposed Redis systems could be vulnerable out of more than **307,000** observed Redis instances. The worm uses a **P2P architecture** to spread, exchange node lists, and deliver updated binaries, giving operators a built-in mechanism to expand the botnet and push future payloads. Unit 42 also observed scanning for additional exposed Redis hosts and port **`22`** for SSH, although no confirmed SSH exploitation was seen. On Windows, the malware showed persistence and defense-evasion behavior including firewall rule changes, obfuscated PowerShell, a monitor process, self-updating binaries, and deletion of the initial dropper. Binaries named **`miner`** and **`winminer`** were recovered, but researchers said they found no definitive evidence that cryptomining had been activated.
Aug 14, 2026
Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the **P2PInfect** botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the `SLAVEOF` command and, in some cases, leveraging `CVE-2022-0543` for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads. Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled **TeamPCP** as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, **PCPJack**, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.
Jun 29, 2026
ESET detailed **Linux/Shishiga**, a Lua-based malware family targeting GNU/Linux systems across IoT-focused architectures including **MIPS, ARM, i686, and PowerPC**. The malware spreads by brute-forcing weak **Telnet** and **SSH** credentials and differs from many Linux worms by combining **BitTorrent**, **SSH**, **Telnet**, and **HTTP** for propagation and command-and-control activity. Researchers said the malware is packed with **UPX**, statically linked with the Lua runtime, and can deploy a main loader with the `.lm` extension alongside a backdoor with the `.dm` extension that listens on **TCP port 2015**. Shishiga’s modules support credential theft, architecture detection, persistence, scanning, file upload, and retrieval of updates and scripts through BitTorrent-delivered `.bt` files. Infected systems may also expose an HTTP service on **port 8888**, with the unusual response **`HTTP/1.0 404 OK`** on the root path serving as an indicator of compromise. ESET identified **`93.117.137.35`** as a command-and-control server, while Censys found roughly 10 Internet-facing IPs matching the malware’s HTTP fingerprint, indicating a limited but active infection set and a malware project still under active development.
Aug 14, 2026