Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise
An investigation identified persistent P2Pinfect botnet presence within Google Kubernetes Engine clusters at multiple organizations, with one compromise lasting six months. The intrusions originated from exposed Redis instances that provided initial access. The botnet utilizes a peer-to-peer architecture for resilience against takedowns and operates as a botnet-for-hire platform. While no second-stage payloads were executed in observed cases, the malware has been linked to ransomware and cryptocurrency mining deployment. A new deployment script was discovered, and evidence suggests P2Pinfect has expanded exploitation techniques to include CVE-2025-11953 (Metro4Shell) targeting React vulnerabilities. Possible incorporation of CVE-2025-49844 (RediShell) is speculated. The campaign demonstrates how single misconfigurations enable long-term compromise in cloud environments.
Pulse ID: 6a0e3753562a6e67c9d9aac4
Pulse Link: https://otx.alienvault.com/pulse/6a0e3753562a6e67c9d9aac4
Pulse Author: AlienVault
Created: 2026-05-20 22:36:03
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Cloud #CyberSecurity #Google #InfoSec #Malware #NATO #OTX #OpenThreatExchange #RAT #RansomWare #Redis #bot #botnet #cryptocurrency #AlienVault