Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm

Summary: Unit 42 researchers discovered P2PInfect, a Rust-written peer-to-peer worm, on July 11, 2023, in a Redis container inside their HoneyCloud honeypot environment. The worm exploits the Lua sandbox escape vulnerability CVE-2022-0543, rated 10.0 in the NIST National Vulnerability Database, to infect Redis instances on Linux and Windows, then joins a P2P network to pull down additional payloads including a scanner.

Key Takeaway: Unit 42 counted over 307,000 unique Redis systems communicating publicly in a two-week window, of which 934 may be vulnerable to this variant, and it assesses the campaign as the first stage of a potentially more capable attack built on a P2P command-and-control network with auto-updating.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Mentions
CVE-2022-0543
Related