#p2pinfect — Public Fediverse posts

P2Pinfect Botnet Now Targets Servers with Ransomware, Cryptominer
https://hackread.com/p2pinfect-botnet-target-server-ransomware-cryptominer/ #Cybercrime #Malware #Botnet #P2Pinfect

P2Pinfect Botnet Now Targets Servers with Ransomware, Cryptominer https://hackread.com/p2pinfect-botnet-target-server-ransomware-cryptominer/ #Cybersecurity #Cryptominer #Ransomware #P2PInfect #Security #Malware #Botnet #Redis

Mentioned Malware Families: P2Pinfect, P2Pinfect

Aliases for P2Pinfect: elf.p2pinfect
Malpedia link for P2Pinfect: https://malpedia.caad.fkie.fraunhofer.de/details/elf.p2pinfect
Aliases for P2Pinfect: elf.p2pinfect
Malpedia link for P2Pinfect: https://malpedia.caad.fkie.fraunhofer.de/details/elf.p2pinfect

#P2Pinfect #P2Pinfect

Aliases provided by Malpedia.

Found a #P2Pinfect sample that's available on VT: 7ca878dc7c8a9b9e9b54faf9b1b354e657ad890ba2cf67b26f3d66d1a7757479

Currently looking into #P2Pinfect malware. Seems to be difficult to source a sample. Anybody got one?

During the scanning phase, the brute-force attempts against SSH servers leverage common username and password pairs embedded within the ELF binary itself.

#Cybersecurity #IoT #Malware #MIPS #Botnet #Routers #P2PInfect #SSH

https://cybersec84.wordpress.com/2023/12/04/new-p2pinfect-botnet-threatens-routers-and-iot-devices-with-mips-variant/

P2PInfect malware variant targets IoT devices https://www.iottechnews.com/news/2023/dec/04/p2pinfect-malware-variant-targets-iot-devices/ #p2pinfect #iot #cybersecurity #hacking #infosec #security #news #tech #technology

The majority of compromised systems have been reported in China, the U.S., Germany, the U.K., Singapore, Hong Kong, and Japan.

#Cybersecurity #Malware #Cyberthreat #P2PInfect

https://cybersec84.wordpress.com/2023/09/22/p2pinfect-malware-activity-surges-600x/

"🚀 P2PInfect Botnet Skyrockets: A 600X Surge in Traffic Unveiled by Cado Security Labs 🚀"

Cado Security Labs has unveiled a staggering 600X increase in P2PInfect traffic since August 28, with a notable 12.3% spike just a week before the publication of their findings. The botnet, primarily targeting servers hosting publicly-accessible instances of Redis, has seen its tentacles spread across China, the US, Germany, the UK, Singapore, Hong Kong, and Japan. The malware, dubbed P2PInfect, has evolved significantly since its discovery in July 2023, showcasing a self-update mechanism and a rapid release of new variants by its developers. The botnet's exponential growth is alarming, with its nodes now spanning across major Cloud Service Providers (CSPs) in both East-Asian and American regions. The malware's primary objective remains elusive, although its rapid iteration and geographical spread hint at a larger, possibly more nefarious agenda in the offing. The detailed analysis by Cado also sheds light on the botnet's sophisticated evasion and persistence mechanisms, making it a formidable threat to global cybersecurity.

Source: Cado Security Labs

Tags: #P2PInfect #Botnet #CyberSecurity #Malware #CadoSecurityLabs #Redis #CloudSecurity #CyberThreats #InfoSec

🐘🔒 Technical Mastodon Toot 🔒🐘

Title: P2Pinfect - Self-Replicating Worm Malware Targeting Redis Data Stores 🐛

P2Pinfect is a self-replicating worm malware actively targeting exposed Redis data stores. Redis is a popular in-memory multi-modal database known for its sub-millisecond latency, used by companies like Twitter, GitHub, Snapchat, Craigslist, and StackOverflow for live-streaming and quick-response use cases. 🌐🗃️

💣 Malware Capabilities:

• Attempts multiple Redis exploits for initial access.
• Utilizes Rust for payload development, making analysis tricky.
• Uses multiple evasion techniques to hinder dynamic analysis.
• Conducts internet scanning for Redis and SSH servers.
• Self-replicates in a worm-like manner. 🐍🔁

📥 Infection Mechanism:
P2Pinfect exploits a critical vulnerability (CVE-2022-0543) and replicates the main database for high availability and counter failover scenarios. After compromising a vulnerable Redis instance, P2Pinfect downloads new OS-specific scripts and malicious binaries and adds the server to its list of infected systems. The malware adds the infected server to its peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads. 🚪🌐🔓

💣 Payload Execution:
The primary payload is an ELF binary written in a combination of C and Rust. After execution, the binary updates the SSH configuration of the host, enabling the attacker to connect to the server via SSH with password authentication. The threat actor then restarts the SSH service and adds an SSH key to the list of authorized keys for the current user. 🔑🚀💻

💼 Post-Infection Actions:

• Renames the wget and curl binaries to hinder incident responders from using them for forensics.
• Checks for the presence of specific utilities (iptables, awk, netstat) and installs them if not available.
• Uses netstat and awk to collect a list of all IPs currently connected to the Redis server.
• Adds iptables rules to allow traffic from these IPs to the Redis server and deny all other traffic to the Redis server. All traffic is allowed to a randomly chosen port the primary payload listens on for botnet communications. 🛡️🕵️‍♂️📊

🤖 Botnet Formation:
The infected server receives at least one binary that can scan through /proc and monitor changes. The binary can upgrade the main malware binary if its signature does not match the one pulled from the botnet. Each compromised Redis server becomes a node, turning the network into a peer-to-peer botnet without the need for a centralized command and control (C2) server. 🕸️🌐🤯

🧩 Conclusion:
The purpose of P2Pinfect remains unclear. Although a binary called "miner" is present, no evidence of cryptomining has been observed. It is possible that this is just the initial stage of the campaign, and additional functionality, possibly cryptomining, will be added after a sufficient number of Redis instances have been compromised. The malware's use of Rust and C's Foreign Function Interface feature adds complexity, making it difficult to detect and analyze. 🕵️‍♀️🛡️💻

📚 Sources:
🔗 https://www.neowin.net/news/self-replicating-worm-malware-infects-exposed-redis-data-store-used-for-live-streaming/
🔗 https://linuxsecurity.com/news/vendors-products/worm-like-botnet-malware-targeting-popular-redis-storage-tool
🔗 https://www.bleepingcomputer.com/news/security/p2pinfect-server-botnet-spreads-using-redis-replication-feature/

Stay vigilant, stay secure! 🛡️🔒 #Cybersecurity #Malware #Redis #P2Pinfect #TechThreats

🚨 BREAKING: A highly sophisticated P2P worm named "P2PInfect" is wreaking havoc on Redis instances! 🐛💻 It exploits the critical CVE-2022-0543 vulnerability in the Lua Library with a 10.0 severity score on CVSSv3 scale. Once in, it alters firewalls, granting unrestricted access to operators. 😱

P2PInfect establishes a P2P connection via port 60100 to a large C2 botnet, but no evidence of cryptomining yet. 😮 934 out of 307,000 Redis instances have already fallen victim. 😨

What's scarier? P2PInfect is using Rust, favored by ransomware groups for fast encryption and evading detection. 🦾

🔒 Stay safe! Update your Redis and amp up your cybersecurity practices NOW! 🔒

Source: Unit 42 researchers https://www.hackread.com/self-replicating-p2pinfect-worm-redis-instances/

Key points:
- The worm, known as P2PInfect, is written in Rust and targets the popular open-source database software Redis.
- It exploits a critical vulnerability (CVE-2022-0543) in the Lua Library, which has a severity score of 10.0 on the CVSSv3 scale.
- Once inside a Redis instance, the worm alters local firewall settings, blocking legitimate access and granting unrestricted access to the worm operators.
- The worm establishes a P2P connection via port 60100 to a large command and control (C2) botnet. There's no evidence yet of P2PInfect engaging in cryptomining using infected instances.
- The worm's rapid spread has been noted, with 934 out of 307,000 publicly-communicating Redis instances identified as vulnerable.
- The use of Rust by P2PInfect is concerning as many ransomware groups have shifted to Rust for its benefits, such as faster encryption and evading common detection methods.
- Organizations and individuals are urged to update their Redis instances and implement robust cybersecurity practices to safeguard against potential attacks.

A highly sophisticated peer-to-peer (P2P) worm named "P2PInfect" has been identified by researchers from Unit 42. It targets instances of the popular open-source database software Redis, exploiting a critical vulnerability known as CVE-2022-0543 in the Lua Library. This vulnerability has received a maximum severity score of 10.0 on the CVSSv3 severity scale. Once inside a Redis instance, the worm establishes a foothold in cloud container environments, alters firewall settings, and grants the operators unrestricted access. P2PInfect employs sophisticated techniques for persistence, ensuring long-term presence on infected systems. It establishes a P2P connection to a large command and control botnet, raising concerns about potential future mining activities.

P2PInfect's use of the Rust programming language is unique and concerning to cybersecurity experts, as it offers benefits such as faster encryption and evading common detection methods. The worm's rapid spread has been observed, and organizations are urged to update their Redis instances and implement robust cybersecurity practices. The cybersecurity community must remain vigilant against emerging threats like P2PInfect and other advanced malware strains.

#P2PInfect
#CybersecurityAlert
#Redis
#RustLang
#CVE20220543
#CyberThreat
#Botnet
#CyberAttack
#InfoSec
#Unit42

Vorsicht: Rust-basierter Wurm greift Windows- und Linux-Server an
https://winfuture.de/news,137520.html#amp_tf=Von%20%251%24s&aoh=16900931550204&csi=0&referrer=https%3A%2F%2Fwww.google.com&ampshare=https%3A%2F%2Fwinfuture.de%2Fnews%2C137520.html #Cybercrime #Malware #Computerwurm #P2PInfect

New #P2PInfect #worm #malware is going after #Linux & #Windows #Redis servers.

Unfortunately some admins have exposed their Redis servers on to the public internet. Redis was not designed to be exposed directly to the Internet so they don't come with access controls enabled by default.

#infosec #cybersecurity

https://www.bleepingcomputer.com/news/security/new-p2pinfect-worm-malware-targets-linux-and-windows-redis-servers/