Recent telemetry has uncovered persistent P2Pinfect botnet presences embedded deep within Google Kubernetes Engine (GKE) clusters across multiple client organizations, with one notable compromise remaining undetected for six full months. These multi-platform, Rust-based threats initially established their footholds via unsecured, internet-exposed Redis instances. This access vector was continuously flagged via FortiCNAPP Composite Alerts, illustrating the severe risk that single misconfigurations pose to long-term cloud security.
Unlike traditional botnets that rely on centralized Command and Control (C2) servers, P2Pinfect utilizes a decentralized peer-to-peer (P2P) mesh architecture. This structural choice makes the botnet remarkably resilient to conventional counter-measures like DNS sinkholing—where malicious traffic is redirected to a controlled environment to neutralize the threat. Instead, the self-propagating worm focuses on maximizing enrollment scale and maintaining a dormant, persistent presence before eventually deploying destructive second-stage payloads such as ransomware or crypto-miners.
Deconstructing the Technical Blueprint: Obfuscation and Deployment Mechanics
A technical analysis of the infection cluster reveals an elegant but highly obfuscated deployment pipeline. Attackers leverage a shell-based dropper named deployer.sh (MD5: 80676a539765a9e117f20b6b99887eca) to retrieve a UPX-packed Rust binary targeting Linux x86_64 systems from an external peer host, writing it directly to /top/RarF51vUe0. Upon execution, the binary processes a massive base64-encoded argument blob using a ChaCha20 stream cipher.
Fascinatingly, the encryption key and nonce are composed entirely of zero bytes, making the cryptographic layer purely decorative and designed solely to frustrate static analysis tools. Once decoded, this payload exposes a structured nodelist featuring a 2-byte header followed by public IP:Port records. This bootstrap peer list allows the freshly compromised host to seamlessly integrate into the wider P2P communication mesh. Furthermore, advanced variants of these P2Pinfect clients have been observed employing usermode rootkit capabilities to maintain deep host-level stealth.
Expanding Exploitation Surfaces: From Redis to Metro4Shell and RediShell
The most alarming aspect of recent campaigns is P2Pinfect’s aggressive expansion of its initial access repertoire. Historically reliant on Redis exploits and basic SSH password spraying, the botnet operators weaponized CVE-2025-11953 (known as Metro4Shell) in November 2025. Metro4Shell is a critical unauthenticated remote code execution vulnerability impacting the React Native Metro development server. Telemetry confirmed that compromised Redis hosts were establishing outbound mesh connections to peers delivering identical UPX-packed P2Pinfect binaries across both Windows and Linux environments, overlapping precisely with public honeypot infrastructure. This rapid weaponization occurred just a week after public proof-of-concepts emerged, underscoring the agility of the threat actors.
Additionally, there is low-confidence speculation that the operators have incorporated CVE-2025-49844, or RediShell. RediShell allows authenticated users to bypass the Lua sandbox via malicious garbage collection manipulation, mirroring the mechanics of CVE-2022-0543, which is a confirmed P2Pinfect vector. While some exposed nodes also suffered from an independent “React2Shell” crypto-mining campaign in December 2025, the primary P2Pinfect infrastructure operates under a distinct “botnet-for-hire” model. The core operators focus strictly on infrastructure scale, selling persistent host access to third-party cybercriminals who subsequently deploy their own secondary payloads after prolonged periods of tactical dormancy.
Our Take: The Looming Threat of the Communal Botnet Marketplace
The multi-month survival of P2Pinfect within enterprise GKE clusters highlights a fundamental, systemic flaw in modern cloud infrastructure management: the gap between rapid deployment and proactive configuration hygiene. Security teams frequently treat internal database instances as implicitly safe, leaving them exposed to the public internet where opportunistic threat actors lie in wait. P2Pinfect’s rapid adoption of Metro4Shell and potential integration of RediShell demonstrate that botnet operators are no longer slow-moving script kiddies. They operate like modern, agile software enterprises, weaponizing critical zero-days and sandbox escapes within days of public disclosure to maximize their asset inventory.
What makes this case truly insidious is the “botnet-for-hire” monetization model. The lack of immediate secondary payloads during the initial six months should not be mistaken for a failed attack or benign activity; it is a calculated period of dormancy designed to preserve the commercial value of the access pool. Organizations must move away from reactive, signature-based detection and shift toward strict network micro-segmentation and continuous automated configuration auditing. If your cloud security strategy allows an unpatched development server or an exposed database node to talk to non-standard external ports for half a year without triggering isolation protocols, the battle is already lost.
