Jul 31, 2023THNCyber Risk / Botnet

The P2PInfect peer-to-peer (P2) worm has been noticed using beforehand undocumented preliminary entry strategies to breach inclined Redis servers and cord them right into a botnet.

“The malware compromises uncovered situations of the Redis information retailer by exploiting the replication characteristic,” Cado Safety researchers Nate Invoice and Matt Muir mentioned in a report shared with The Hacker Information.

“A standard assault sample towards Redis in cloud environments is to take advantage of this characteristic utilizing a malicious occasion to allow replication. That is achieved by way of connecting to an uncovered Redis occasion and issuing the SLAVEOF command.”

The Rust-based malware was first documented by Palo Alto Networks Unit 42, calling out the malware’s potential to take advantage of a essential Lua sandbox escape vulnerability (CVE-2022-0543, CVSS rating: 10.0) to acquire a foothold into Redis situations. The marketing campaign is believed to have commenced on or after June 29, 2023.

Nevertheless, the most recent discovery means that the risk actors behind the marketing campaign are leveraging a number of exploits for preliminary entry.

This isn’t the primary time the SLAVEOF command has been abused within the wild. Beforehand, risk actors related to malware households resembling H2Miner and HeadCrab have abused the assault approach to illicitly mine cryptocurrency on compromised hosts.

In doing so, the objective is to copy a malicious occasion and cargo a malicious module to activate the an infection.

One other preliminary entry vector entails the registration of a malicious cron job on the Redis host to obtain the malware from a distant server upon execution, a technique beforehand noticed in assaults mounted by the WatchDog cryptojacking group.

A profitable breach is adopted by the distribution of next-stage payloads that permit the malware to change iptables firewall guidelines at will, improve itself, and doubtlessly deploy cryptocurrency miners at a later date as soon as the botnet has grown to a particular measurement.

“The P2Pinfect malware makes use of a peer-to-peer botnet,” the researchers mentioned. “Every contaminated server is handled as a node, which then connects to different contaminated servers. This permits your entire botnet to gossip with one another with out utilizing a centralized C2 server.”

A notable trait of the botnet is its worming habits, enabling it to increase its attain by utilizing a listing of passwords to brute-force SSH servers and trying to take advantage of the Lua sandbox escape vulnerability or use the SLAVEOF command within the case of Redis servers.

“P2Pinfect is well-designed and makes use of subtle methods for replication and C2,” the researchers concluded. “The selection of utilizing Rust additionally permits for simpler portability of code throughout platforms (with the Home windows and Linux binaries sharing plenty of the identical code), whereas additionally making static evaluation of the code considerably tougher.”