BREAKING: A highly sophisticated P2P worm named "P2PInfect" is wreaking havoc on Redis instances! 
It exploits the critical CVE-2022-0543 vulnerability in the Lua Library with a 10.0 severity score on CVSSv3 scale. Once in, it alters firewalls, granting unrestricted access to operators. 
P2PInfect establishes a P2P connection via port 60100 to a large C2 botnet, but no evidence of cryptomining yet. 
934 out of 307,000 Redis instances have already fallen victim. 
What's scarier? P2PInfect is using Rust, favored by ransomware groups for fast encryption and evading detection. 
Stay safe! Update your Redis and amp up your cybersecurity practices NOW!
Source: Unit 42 researchers https://www.hackread.com/self-replicating-p2pinfect-worm-redis-instances/
Key points:
- The worm, known as P2PInfect, is written in Rust and targets the popular open-source database software Redis.
- It exploits a critical vulnerability (CVE-2022-0543) in the Lua Library, which has a severity score of 10.0 on the CVSSv3 scale.
- Once inside a Redis instance, the worm alters local firewall settings, blocking legitimate access and granting unrestricted access to the worm operators.
- The worm establishes a P2P connection via port 60100 to a large command and control (C2) botnet. There's no evidence yet of P2PInfect engaging in cryptomining using infected instances.
- The worm's rapid spread has been noted, with 934 out of 307,000 publicly-communicating Redis instances identified as vulnerable.
- The use of Rust by P2PInfect is concerning as many ransomware groups have shifted to Rust for its benefits, such as faster encryption and evading common detection methods.
- Organizations and individuals are urged to update their Redis instances and implement robust cybersecurity practices to safeguard against potential attacks.
A highly sophisticated peer-to-peer (P2P) worm named "P2PInfect" has been identified by researchers from Unit 42. It targets instances of the popular open-source database software Redis, exploiting a critical vulnerability known as CVE-2022-0543 in the Lua Library. This vulnerability has received a maximum severity score of 10.0 on the CVSSv3 severity scale. Once inside a Redis instance, the worm establishes a foothold in cloud container environments, alters firewall settings, and grants the operators unrestricted access. P2PInfect employs sophisticated techniques for persistence, ensuring long-term presence on infected systems. It establishes a P2P connection to a large command and control botnet, raising concerns about potential future mining activities.
P2PInfect's use of the Rust programming language is unique and concerning to cybersecurity experts, as it offers benefits such as faster encryption and evading common detection methods. The worm's rapid spread has been observed, and organizations are urged to update their Redis instances and implement robust cybersecurity practices. The cybersecurity community must remain vigilant against emerging threats like P2PInfect and other advanced malware strains.
#P2PInfect
#CybersecurityAlert
#Redis
#RustLang
#CVE20220543
#CyberThreat
#Botnet
#CyberAttack
#InfoSec
#Unit42
KI-generierte Malware: Unbegrenzte Möglichkeiten für Kriminelle
H3lium@infosec.exchange/:~# 
that followed the Unit 42 blog...
to ask for it to be removed.
