P2PINFECT Worm infects Redis Instances

Researchers have discovered a peer-to-peer worm dubbed P2PInfect targeting the open-source database application Redis that was being used in cloud environments using a vulnerability tracked as CVE-2022-0543.

Out of 307,000 unique Redis systems, only 934 instances may be vulnerable. The worm may knock on the door of all of them in an attempt to compromise the systems.

The P2PInfect worm attempts to exploit CVE-2022-0543, a critical vulnerability that allows for a Lua sandbox escape, which could lead to remote code execution. This worm has also been observed infecting Redis servers on both Linux and Windows operating systems, making it “more scalable and potent than other worms

Advertisements

After exploitation of CVE-2022-0543 to gain initial access, it deploys a payload to establish communication with a P2P network. Once this communication channel is established, which acts as a C2 botnet network as well, malicious binaries and scripts are pulled down to do some enumeration of the host. It is thought that this is only the first stage of a larger attack, with instances of the word “miner” in the P2PInfect binaries.

This campaign has not been tied to any groups that are known for targeting Redis instances or doing worm-like operations. Therefore, this may be an entirely new threat actor or otherwise malicious hacking group emerging. The researchers also note that this malware is “well designed with several modern development choices,” including the use of the Rust programming language allowing for “resilient capabilities and the flexibility to allow the worm to rapidly spread across multiple operating systems.”

Organizations monitor all Redis applications, both on-premises and within cloud environments, to ensure they do not contain random filenames within the /tmp directory. Additionally, DevOps personnel should continually monitor their Redis instances to ensure they maintain legitimate operations and maintain network access.