New P2PInfect Worm Targeting Redis Servers on Linux and Windows Systems

Summary:

Researchers uncovered a novel peer-to-peer (P2P) worm dubbed P2PInfect, written in the highly scalable and cloud-friendly programming language, Rust. This worm exhibits cross-platform capabilities and targets Redis, a widely used open-source database application in cloud environments, running on Linux and Windows operating systems. The researchers identified over 307,000 unique Redis systems, with 934 potentially vulnerable to this P2PInfect variant. The P2PInfect worm exploits the CVE-2022-0543 Lua sandbox escape vulnerability to infect vulnerable Redis instances. Once inside, it drops an initial payload that establishes P2P communication with a larger network. The worm proceeds to download additional malicious binaries, including OS-specific scripts and scanning software. The infected system then becomes part of the P2P network, facilitating the distribution of payloads to future compromised Redis instances.[emaillocker id="1283"]

The exploitation of CVE-2022-0543 enables P2PInfect to thrive in cloud container environments, where traditional worms may struggle due to reduced functionality. Unit Researchers detected the worm when it compromised a Redis container instance within their HoneyCloud environment. Although the P2PInfect campaign involves the term "miner" in its toolkit, there is no concrete evidence of cryptomining operations. The P2P network possesses various command and control (C2) features, including "Auto-updating," allowing the controllers to push new payloads into the network to enhance malicious operations. Researchers believes this P2PInfect campaign represents the first stage of a potentially more sophisticated attack that exploits the robust P2P C2 network. While the worm focuses on exposed Redis instances, it also performs scanning attempts over port 22 (SSH) in compromised systems, though the purpose remains unclear. P2PInfect's exploitation of Redis through CVE-2022-0543 is not typical among other cryptojacking-focused worms that target Redis. Its complexity stems from exploiting the Lua vulnerability and the specific focus on Debian or derived distributions. This complexity makes P2PInfect resilient to blocking and network firewall mitigation techniques.

The worm's initial payload is written in Rust, and it uses TLS 1.3 to communicate with other P2P members on the current list of configured nodes. The C2 infrastructure updates automatically when the compromised node sends a request with all known nodes. P2PInfect uses UPX packing for initial payloads, but subsequent malware samples are not packed. P2PInfect's PowerShell script configures the local system firewall to block legitimate access to or from the compromised Redis application. It establishes communication between the compromised host and the P2P network, ensuring persistence for the threat actors. In Windows OS, P2PInfect features a Monitor process responsible for maintaining the worm's functionality on the infected host. The Monitor downloads new P2PInfect versions from the network, persists them with random names, and executes them to scan for additional vulnerable Redis instances. The worm's design and use of a P2P network for auto-propagation are unique in the cloud and cryptojacking threat landscape. Researchers have identified multiple P2PInfect samples, and they anticipate the number of nodes in the malicious network is growing due to the high number of potential targets.

To protect against P2PInfect, organizations are advised to monitor Redis applications in both on-premises and cloud environments, ensuring no random filenames exist within the /tmp directory. DevOps personnel should continuously monitor Redis instances to maintain legitimate operations and network access, and all Redis instances should be kept updated to their latest versions.

Threat Profile:

References:

The following reports contain further technical details:

https://thehackernews.com/2023/07/new-p2pinfect-worm-targeting-redis.html