# P2Pinfect Kubernetes Compromise — Exposed Redis Enables Persistent GKE Botnet Enrollment with Six-Month Dormancy (CVE-2022-0543, CVE-2025-11953, CVE-2025-49844)

> FortiGuard Labs documented persistent P2Pinfect botnet presence in Google Kubernetes Engine (GKE) clusters across multiple client environments, with one compromise dormant for six months before discovery. Initial access was achieved via Internet-exposed Redis pods accepting unauthenticated commands, abused for Lua sandbox escape (CVE-2022-0543) and SLAVEOF / CONFIG SET module-loading primitives. The Rust-written, UPX-packed P2Pinfect client enrolled compromised pods into the gossip-based peer mesh and remained operationally silent, awaiting an operator push. Fortinet telemetry shows the campaign expanding beyond Redis to React Native Metro dev servers (CVE-2025-11953, 'Metro4Shell') and credible incorporation of the RediShell Redis Lua use-after-free (CVE-2025-49844, Wiz, Oct 2025) into the worm's exploit toolkit.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0537
- **ID:** TL-2026-0537
- **Severity:** HIGH (CVSS 8.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** P2Pinfect Operator
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-0543, CVE-2025-11953, CVE-2025-49844

## Description

**Campaign overview.** P2Pinfect is a self-replicating, Rust-based botnet first publicly documented by Palo Alto Networks Unit 42 in July 2023 and continuously tracked by Cado Security, Akamai SIRT, and Cisco Talos. The botnet uses a permissioned gossip protocol over a flat peer-to-peer mesh — every infected host can both receive and rebroadcast new binaries — and has historically been used to drop XMRig Monero miners and an opportunistic ransomware module (rsagen). The May 2026 FortiGuard Labs report (Misconfigured, Enrolled and Dormant) is the first public confirmation that the operator is targeting managed-Kubernetes runtime environments at scale, with confirmed long-dwell footholds in multiple Google Kubernetes Engine (GKE) tenants. One environment was compromised for approximately six months before detection — the host had been enrolled, beaconed back to the mesh on its expected jitter, and was never tasked with a second-stage payload, which made it invisible to signature-based EDR controls watching for cryptominer or ransomware behavior.

**Initial access — exposed Redis.** Across all confirmed GKE intrusions Fortinet documents the same root cause: a Redis Deployment exposed to the public Internet through a permissive Service or Ingress, accepting commands without requirepass. The operator drives initial code execution by chaining classical Redis abuse primitives: (1) CONFIG SET dir /var/spool/cron/, CONFIG SET dbfilename root, then SAVE to drop a cron entry; (2) MODULE LOAD of an attacker-supplied shared object delivered via SLAVEOF / replication; and (3) on Debian-derived images, the Debian-specific Lua sandbox escape CVE-2022-0543 (package.loadlib reachable from inside the sandbox) for direct RCE. The Lua escape is preferred because it works against pods that have hardened cron and disabled module loading. Fortinet observed the operator probing for all three primitives in sequence and falling back if any single technique was blocked.

**Implant — the Rust P2Pinfect client.** The dropper is a statically-linked Rust binary, UPX-packed, with the upper-case UPX magic deliberately mangled to defeat naive header scanning (upx -d fails; manual fix-up restores the section table). Unpacked, the binary exposes the canonical P2Pinfect strings (p2pinfect, botnet_v3, gossip_round), a libtor-style Tor bundle for fallback C2, and a randomized 30-day-jitter beacon scheduler. Once running, the client (a) enumerates the host (kubelet token, service-account token mounted at /var/run/secrets/kubernetes.io/serviceaccount/, network interfaces, kernel version, container runtime), (b) opens a listener on a high TCP port (observed 60100-60300 random) for inbound gossip peers, (c) connects out to 3-8 hard-coded bootstrap peers and learns additional peers via gossip, and (d) waits. It does not in itself escalate, drop a miner, or move laterally — those actions are operator-tasked over the mesh and were never observed in the six-month dormant case.

**Persistence and dormancy.** P2Pinfect installs persistence at every layer it can reach: a systemd user-unit if /run/systemd is writable, a crontab -e entry inside the pod, a renamed copy of itself in /tmp/.{random}/ plus an LD_PRELOAD shim hooking getuid(), and — most importantly in the GKE case — an in-cluster persistence path. Where the compromised pod runs with a service account that has create pods or patch deployments RBAC, the implant creates a new Deployment in the kube-system namespace mimicking a benign DaemonSet (commonly node-local-cache or metrics-server-helper) whose pod template re-launches the implant. This survives node reboots, pod evictions, and even cluster autoscaler scale-down events. The six-month dormancy case is a direct consequence of this design: nothing the implant does on a dormant peer touches disk I/O, network egress (beyond expected jitter), or process trees in a way that crosses normal EDR thresholds.

**Expansion to React Native Metro (CVE-2025-11953, Metro4Shell).** Fortinet telemetry between February and April 2026 shows P2Pinfect peers initiating scans for React Native Metro development servers exposed on TCP 8081. CVE-2025-11953, disclosed in November 2025, is an unauthenticated remote code execution in the Metro bundler /open-stack-frame-in-editor endpoint, exploitable on any Metro instance reachable on the network and present in @react-native-community/cli-server-api versions <= 20.0.0-alpha.2. The vulnerability allows an attacker to supply an editor command and have the development host execute it; the operator chains it to spawn a curl that retrieves the same Rust dropper used for Redis foothold, indicating the worm now has a multi-vector self-propagation primitive. Targeting Metro on TCP 8081 makes ephemeral CI runners and developer laptops attractive secondary footholds for moving deeper into corporate networks.

**Possible incorporation of RediShell (CVE-2025-49844).** RediShell, disclosed by Wiz Research on 6 October 2025, is a 13-year-old use-after-free in Redis Lua scripting that yields authenticated remote code execution against any Redis instance on which an attacker can issue EVAL. Fortinet did not directly confirm RediShell exploitation in the documented GKE intrusions (the unauthenticated Redis exposure made CVE-2022-0543 sufficient), but the Wiz advisory and follow-on industry tracking note that mass-exploitation kits incorporated RediShell within weeks. Two Fortinet-observed sample variants contain string artifacts (lua_uaf, EVAL_LUA_UAF_POC) that strongly suggest the operator has at minimum staged the exploit, even if active use against the GKE victims was unnecessary. Defenders should treat RediShell as part of the campaign's exploit toolbox.

**Strategic implication.** The compromised peers are a botnet-for-hire substrate. Operator tasking is asynchronous and silent: a single signed gossip message can convert thousands of dormant Kubernetes peers into a coordinated ransomware deployment, a credential-harvesting wave against cloud metadata services, or a coin-mining cluster within minutes. Defenders cannot wait for second-stage payload behavior to detect this campaign — by the time the second stage fires, the entire mesh has executed in parallel. Detection must focus on initial-access primitives (exposed Redis CONFIG SET, SLAVEOF, MODULE LOAD; Metro /open-stack-frame-in-editor), the dropper's network signature (TCP 60100-60300 listener on a pod), and Kubernetes-control-plane persistence (kube-system DaemonSets impersonating node-local-cache or metrics-server).

## MITRE ATT&CK

- T1595 Active Scanning
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1609 Container Administration Command
- T1610 Deploy Container
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1613 Container and Resource Discovery
- T1526 Cloud Service Discovery
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1090 Proxy
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1496 Resource Hijacking
- T1486 Data Encrypted for Impact

## Sources

- [Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise](https://www.fortinet.com/blog/threat-research/misconfigured-enrolled-and-dormant-anatomy-of-a-p2pinfect-kubernetes-compromise)
- [P2Pinfect: New Peer-to-Peer Worm Targeting Redis Servers](https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/)
- [P2Pinfect Adds Miner and Ransomware Payloads to Arsenal](https://www.cadosecurity.com/blog/p2pinfect-new-variant-targets-mips-devices)
- [RediShell: Critical Remote Code Execution Vulnerability in Redis (CVE-2025-49844)](https://www.wiz.io/blog/redis-rce-cve-2025-49844-redishell)
- [CVE-2025-49844 — Redis Lua Use-After-Free RCE](https://nvd.nist.gov/vuln/detail/CVE-2025-49844)
- [Metro4Shell: Unauthenticated RCE in React Native Metro (CVE-2025-11953)](https://github.com/facebook/metro/security/advisories/GHSA-7w7p-x7xx-mc89)
- [CVE-2025-11953 — React Native Metro open-stack-frame-in-editor RCE](https://nvd.nist.gov/vuln/detail/CVE-2025-11953)
- [CVE-2022-0543 — Debian-specific Redis Lua sandbox escape](https://nvd.nist.gov/vuln/detail/CVE-2022-0543)
- [CISA Known Exploited Vulnerabilities — CVE-2022-0543](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [P2Pinfect Updates Capabilities, Targets MIPS Devices](https://www.akamai.com/blog/security-research/p2pinfect-mips-variant)
- [Hardening Redis: Authentication, Command Renaming, and Network Isolation](https://redis.io/docs/management/security/)
- [Kubernetes Pod Security Admission](https://kubernetes.io/docs/concepts/security/pod-security-admission/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0537