Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise

Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise
FortiGuard Labs found persistent P2Pinfect infections inside Google Kubernetes Engine clusters, traced back to exposed Redis instances and long-dormant botnet activity that can later deliver miners or ransomware. The campaign expanded to use Metro4Shell and possibly RediShell for initial access, with overlap to React2Shell mining activity and identified P2Pinfect deployment artifacts and peer infrastructure. #P2Pinfect #GoogleKubernetesEngine #Metro4Shell #RediShell #React2Shell

Keypoints

  • FortiGuard Labs observed persistent P2Pinfect activity in multiple Google Kubernetes Engine clusters at customer environments, including one compromise lasting six months.
  • The initial foothold came from exposed Redis instances, showing how a single cloud misconfiguration can lead to long-term compromise.
  • No second-stage payload was executed in the observed cases, but P2Pinfect is known to stay dormant before delivering ransomware or crypto miners.
  • A new deployment script, deplyoer.sh, was identified installing P2Pinfect clients and retrieving binaries from a remote host.
  • The botnet’s peer infrastructure overlapped with clients linked to CVE-2025-11953, also known as Metro4Shell, expanding its exploitation beyond Redis to React.
  • Low-confidence evidence suggests P2Pinfect may also be leveraging CVE-2025-49844, or RediShell, while infected hosts were vulnerable to it.
  • Four exposed Redis nodes were also associated with cryptominers from a separate React2Shell exploitation campaign.

MITRE Techniques

  • [T1190 ] Exploit Public-Facing Application – The attackers gained initial access by exploiting exposed Redis and React-related vulnerabilities (‘exposed Redis instances’, ‘using Metro4Shell as an initial access vector’).
  • [T1059.004 ] Command and Scripting Interpreter: Unix Shell – A shell script was used to retrieve and launch the P2Pinfect client (‘This shell-based dropper retrieves a P2Pinfect client binary’).
  • [T1105 ] Ingress Tool Transfer – The malware downloaded its client binary from a remote server (‘retrieves a P2Pinfect client binary from http://8[.]210[.]50[.]65:60126/linux’).
  • [T1027 ] Obfuscated Files or Information – The payload used packing and encoded arguments to conceal behavior (‘UPX-packed Rust executable’, ‘base64-encoded argument blob’).
  • [T1562.001 ] Impair Defenses: Disable or Modify Tools – The botnet’s P2P design and dormancy help resist takedown and detection (‘highly resilient to sinkholing and infrastructure takedowns’, ‘remain dormant for extended periods’).
  • [T1090.002 ] Proxy: External Proxy – P2P peer infrastructure was used to route botnet communications and distribute binaries (‘peer-to-peer (P2P) architecture’, ‘join the botnet mesh’).
  • [T1071.001 ] Application Layer Protocol: Web Protocols – The malware used HTTP-based retrieval and peer communication patterns (‘retrieves a P2Pinfect client binary from http://…’).
  • [T1204 ] User Execution – A deployed client was executed after retrieval by the dropper (‘It then executes the binary’).
  • [T1057 ] Process Discovery – The text notes monitoring of running workloads and execution evidence, consistent with identifying active processes (‘detects when your systems execute known-vulnerable code’).
  • [T1496 ] Resource Hijacking – The campaign included cryptominers and compute hijacking behavior (‘hosting and deploying crypto miners’, ‘Compute Hijacking’).
  • [T1055 ] Process Injection – Some variants reportedly have usermode rootkit capabilities, implying stealthy process manipulation (‘Some variants … have usermode rootkit capabilities’).
  • [T1611 ] Escape to Host – RediShell and related Redis sandbox escapes enabled execution outside the intended sandbox (‘bypass the Lua sandbox’, ‘sandbox escape vulnerability’).
  • [T1068 ] Exploitation for Privilege Escalation – Exploitation of sandbox escape flaws was used to gain native execution (‘granting native code execution’).

Indicators of Compromise

  • [IP addresses ] P2Pinfect peer infrastructure and payload hosting, plus bootstrap nodelist records – 8[.]210[.]50[.]65, 8[.]218[.]225[.]42, and 2 more IPs
  • [File hashes ] Deployment script and client binaries recovered from the campaign – 80676a539765a9e117f20b6b99887eca, 5d1ca537c4bedebf2f4d276d4199ea95, and 3 more hashes
  • [File names ] Deployment and payload artifacts used by the botnet – deplyoer.sh, /top/RarF51vUe0
  • [URLs ] Binary download source used by the dropper – http://8[.]210[.]50[.]65:60126/linux
  • [Ports ] Non-standard peer communication and payload delivery ports – 60126, plus other non-standard peer ports
  • [Vulnerability identifiers ] Exploitation vectors linked to botnet spread – CVE-2025-11953, CVE-2025-49844, CVE-2022-0543


Read more: https://feeds.fortinet.com/~/956771309/0/fortinet/blog/threat-research~Misconfigured-Enrolled-and-Dormant-Anatomy-of-a-PPinfect-Kubernetes-Compromise