www.darkreading.com
Open in
urlscan Pro
2606:4700::6810:e0ab
Public Scan
URL:
https://www.darkreading.com/threat-intelligence/p2pinfect-worm-miner-ransomware-rootkit
Submission: On June 25 via api from TR — Scanned from DE
Submission: On June 25 via api from TR — Scanned from DE
Form analysis
0 forms found in the DOMText Content
Dark Reading is part of the Informa Tech Division of Informa PLC Informa PLC|ABOUT US|INVESTOR RELATIONS|TALENT This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales and Scotlan. Number 8860726. Black Hat NewsOmdia Cybersecurity Newsletter Sign-Up Newsletter Sign-Up Cybersecurity Topics RELATED TOPICS * Application Security * Cybersecurity Careers * Cloud Security * Cyber Risk * Cyberattacks & Data Breaches * Cybersecurity Analytics * Cybersecurity Operations * Data Privacy * Endpoint Security * ICS/OT Security * Identity & Access Mgmt Security * Insider Threats * IoT * Mobile Security * Perimeter * Physical Security * Remote Workforce * Threat Intelligence * Vulnerabilities & Threats World RELATED TOPICS * DR Global * Middle East & Africa See All The Edge DR Technology Events RELATED TOPICS * Upcoming Events * Podcasts * Webinars SEE ALL Resources RELATED TOPICS * Library * Newsletters * Podcasts * Reports * Videos * Webinars * Whitepapers * * * * * Partner Perspectives: * > Microsoft SEE ALL * Threat Intelligence * Application Security * Сloud Security * Endpoint Security 'P2PINFECT' WORM GROWS TEETH WITH MINER, RANSOMWARE & ROOTKIT For a while, the botnet spread but did essentially nothing. All the malicious payloads came well after. Nate Nelson, Contributing Writer June 25, 2024 4 Min Read Source: Phil Degginger via Alamy Stock Photo A previously harmless Linux botnet has been updated to include a suite of malicious and exploitative components. The unimaginatively named "P2PInfect" is a worm that leverages the Redis in-memory database application to spread across networks in a peer-to-peer, worm-like manner, creating a botnet along the way. By the time it was first discovered about a year ago, it had yet to cause anyone any real damage — a fact which it used to stealthy effect, by creating very little ruckus in newly infected networks. This is not the case anymore. According to Cado Security, an update has been propagated across P2PInfect infections globally which includes a brand new rootkit, cryptominer, and even ransomware. "Last year we were sitting there, scratching our heads, going: 'Why?,'" Al Carchrie, R&D lead solutions engineer at Cado Security, recalls about seeing the innocuous botnet for the first time. "It wasn't until the last couple of weeks that we saw there had been changes — it seems to have grown arms and legs." HOW PRPINFECT STARTED On first impression, researchers observed a few things about P2PInfect that they could explain, and a few they couldn't. First, the known: P2PInfect targeted misconfigured Redis-integrated servers accessible from the Internet. With such an inroad into a network, the malware took advantage of Redis' leader-follower topology, in which a designated "leader" node handles the primary copy of some data, and spreads exact copies to a network of follower nodes. The program used this mechanism to spread itself between Redis nodes across networks. This seemed to be a good way to establish command-and-control (C2) and potentially spread second-stage malware. At the time, though, this quasi botnet wasn't being used for much at all. Researchers did note, though, that the word "miner" popped up in P2PInfect's code — a potential indication of what was to come, perhaps, but nothing more. "Our best estimate was that they were trying to do an initial spread as a botnet, probably to get a significant mass, so that when their plan came into action, it would then be more effective because they'll have a significant number of hosts," Carchrie says. That prediction has now come to fruition. HOW P2PINFECT IS GOING P2PInfect has been updated with a usermode rootkit, and its "miner" binary has been activated. In the time since, the malware has leveraged its victims to mine around 71 Monero coins, equivalent to around £10,000. Interesting, too, is a new ransomware component targeting a variety of file types including .xls, .py, .sql, and more. Though scary in theory, this aspect of P2PInfect seems to have been thought through the least. For one thing, the ransomware looks for specific file extensions, but Linux does not necessarily require that files have extensions to begin with. More to the point: Redis doesn't save any data to disk by default—its whole value proposition surrounds storage in-memory. It can be configured to save data to files, but the extension for these files—.rdb—is not among those sought by the ransomware. "With that in mind," Cado wrote, "it's unclear what the ransomware is actually designed to ransom." WHAT TO DO From Carchrie's vantage point, P2PInfect infections appear to be most concentrated in East Asia. Redis is commonly used in businesses across the globe, though. Its open source version has more than four billion Docker pulls, and nearly 10,000 organizations use its Enterprise product, including British Airways and MGM Resorts. So, he warns, organizations have to watch that their servers are properly protected from outside threats — only exposed to trusted users, behind firewalls, properly configured, etc. And while it's not so easy to spot totally dormant malware, now that P2PInfect is revved up, it should be leaving behind plenty of easily detectable artifacts. "The cryptomining is going to drain as much CPU as possible, and the ransomware will go after files on disks, so disk utilization then starts to spike as well. You'll be looking for indications of those," he says. ABOUT THE AUTHOR(S) Nate Nelson, Contributing Writer Nate Nelson is a freelance writer based in New York City. Formerly a reporter at Threatpost, he contributes to a number of cybersecurity blogs and podcasts. He writes "Malicious Life" -- an award-winning Top 20 tech podcast on Apple and Spotify -- and hosts every other episode, featuring interviews with leading voices in security. He also co-hosts "The Industrial Security Podcast," the most popular show in its field. See more from Nate Nelson, Contributing Writer Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox. Subscribe You May Also Like -------------------------------------------------------------------------------- Threat Intelligence Sisense Password Breach Triggers 'Ominous' CISA Warning Threat Intelligence 'Magnet Goblin' Exploits Ivanti 1-Day Bug in Mere Hours Threat Intelligence Microsoft, OpenAI: Nation-States Are Weaponizing AI in Cyberattacks Threat Intelligence 'Coyote' Malware Begins Its Hunt, Preying on 61 Banking Apps More Insights Webinars * Empowering Developers, Automating Security: The Future of AppSec June 27, 2024 More Webinars Events * Black Hat USA - Aug 3-8 - The Premier Technical Cybersecurity Conference - Learn More August 3, 2024 * Black Hat Europe - December 9-12 - Learn More December 10, 2024 * SecTor - Canada's IT Security Conference Oct 22-24 - Learn More October 22, 2024 More Events EDITOR'S CHOICE VMware logo in black and white Сloud Security Critical VMware Bugs Open Swaths of VMs to RCE, Data TheftCritical VMware Bugs Open Swaths of VMs to RCE, Data Theft byNate Nelson, Contributing Writer Jun 18, 2024 3 Min Read Two astronauts walking on the surface of an alien planet with rover in the background Cyber Risk Space: The Final Frontier for CyberattacksSpace: The Final Frontier for Cyberattacks byJai Vijayan, Contributing Writer Jun 17, 2024 6 Min Read Closeup of Japanese yellow joro spider Remote Workforce Scattered Spider Pivots to SaaS Application AttacksScattered Spider Pivots to SaaS Application Attacks byJai Vijayan, Contributing Writer Jun 18, 2024 4 Min Read Reports * 2023 Global Threat Report * EMA: AI at your fingertips: How Elastic AI Assistant simplifies cybersecurity * Industrial Networks in the Age of Digitalization * Zero-Trust Adoption Driven by Data Protection * How Enterprises Assess Their Cyber-Risk More Reports White Papers * The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2023 * 5 Essential Insights into Generative AI for Security Leaders * Elastic named a Leader in The Forrester Wave™: Security Analytics Platforms, Q4 2022 * The Future of Cloud Security: Attack Paths & Graph-based Technology * The Cloud Threat Landscape: Security learnings from analyzing 500+ cloud environments More Whitepapers Events * Black Hat USA - Aug 3-8 - The Premier Technical Cybersecurity Conference - Learn More August 3, 2024 * Black Hat Europe - December 9-12 - Learn More December 10, 2024 * SecTor - Canada's IT Security Conference Oct 22-24 - Learn More October 22, 2024 More Events DISCOVER MORE WITH INFORMA TECH Black HatOmdia WORKING WITH US About UsAdvertiseReprints JOIN US Newsletter Sign-Up FOLLOW US Copyright © 2024 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. Home|Cookie Policy|Privacy|Terms of Use Cookies Button WE CARE ABOUT YOUR PRIVACY We and our 842 partners store and/or access information on a device, such as unique IDs in cookies to process personal data. You may accept or manage your choices by clicking below, including your right to object where legitimate interest is used, or at any time in the privacy policy page. These choices will be signaled to our partners and will not affect browsing data.Privacy Policy WE AND OUR PARTNERS PROCESS DATA TO PROVIDE: Use precise geolocation data. Actively scan device characteristics for identification. Store and/or access information on a device. Personalised advertising and content, advertising and content measurement, audience research and services development. List of Partners (vendors) I Accept Essential Only Show Purposes ABOUT YOUR PRIVACY We process your data to deliver content or advertisements and measure the delivery of such content or advertisements to extract insights about our website. We share this information with our partners on the basis of consent and legitimate interest. You may exercise your right to consent or object to a legitimate interest, based on a specific purpose below or at a partner level in the link under each purpose. These choices will be signaled to our vendors participating in the Transparency and Consent Framework. More information Allow All MANAGE CONSENT PREFERENCES PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details STORE AND/OR ACCESS INFORMATION ON A DEVICE 676 PARTNERS CAN USE THIS PURPOSE Store and/or access information on a device Cookies, device or similar online identifiers (e.g. login-based identifiers, randomly assigned identifiers, network based identifiers) together with other information (e.g. browser type and information, language, screen size, supported technologies etc.) can be stored or read on your device to recognise it each time it connects to an app or to a website, for one or several of the purposes presented here. List of IAB Vendors | View Illustrations PERSONALISED ADVERTISING AND CONTENT, ADVERTISING AND CONTENT MEASUREMENT, AUDIENCE RESEARCH AND SERVICES DEVELOPMENT 802 PARTNERS CAN USE THIS PURPOSE Personalised advertising and content, advertising and content measurement, audience research and services development * USE LIMITED DATA TO SELECT ADVERTISING 613 PARTNERS CAN USE THIS PURPOSE Switch Label Advertising presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type or which content you are (or have been) interacting with (for example, to limit the number of times an ad is presented to you). View Illustrations Object to Legitimate Interests Remove Objection * CREATE PROFILES FOR PERSONALISED ADVERTISING 496 PARTNERS CAN USE THIS PURPOSE Switch Label Information about your activity on this service (such as forms you submit, content you look at) can be stored and combined with other information about you (for example, information from your previous activity on this service and other websites or apps) or similar users. This is then used to build or improve a profile about you (that might include possible interests and personal aspects). Your profile can be used (also later) to present advertising that appears more relevant based on your possible interests by this and other entities. View Illustrations * USE PROFILES TO SELECT PERSONALISED ADVERTISING 492 PARTNERS CAN USE THIS PURPOSE Switch Label Advertising presented to you on this service can be based on your advertising profiles, which can reflect your activity on this service or other websites or apps (like the forms you submit, content you look at), possible interests and personal aspects. View Illustrations * CREATE PROFILES TO PERSONALISE CONTENT 220 PARTNERS CAN USE THIS PURPOSE Switch Label Information about your activity on this service (for instance, forms you submit, non-advertising content you look at) can be stored and combined with other information about you (such as your previous activity on this service or other websites or apps) or similar users. This is then used to build or improve a profile about you (which might for example include possible interests and personal aspects). Your profile can be used (also later) to present content that appears more relevant based on your possible interests, such as by adapting the order in which content is shown to you, so that it is even easier for you to find content that matches your interests. View Illustrations * USE PROFILES TO SELECT PERSONALISED CONTENT 193 PARTNERS CAN USE THIS PURPOSE Switch Label Content presented to you on this service can be based on your content personalisation profiles, which can reflect your activity on this or other services (for instance, the forms you submit, content you look at), possible interests and personal aspects. This can for example be used to adapt the order in which content is shown to you, so that it is even easier for you to find (non-advertising) content that matches your interests. View Illustrations * MEASURE ADVERTISING PERFORMANCE 715 PARTNERS CAN USE THIS PURPOSE Switch Label Information regarding which advertising is presented to you and how you interact with it can be used to determine how well an advert has worked for you or other users and whether the goals of the advertising were reached. For instance, whether you saw an ad, whether you clicked on it, whether it led you to buy a product or visit a website, etc. This is very helpful to understand the relevance of advertising campaigns. View Illustrations Object to Legitimate Interests Remove Objection * MEASURE CONTENT PERFORMANCE 361 PARTNERS CAN USE THIS PURPOSE Switch Label Information regarding which content is presented to you and how you interact with it can be used to determine whether the (non-advertising) content e.g. reached its intended audience and matched your interests. For instance, whether you read an article, watch a video, listen to a podcast or look at a product description, how long you spent on this service and the web pages you visit etc. This is very helpful to understand the relevance of (non-advertising) content that is shown to you. View Illustrations Object to Legitimate Interests Remove Objection * UNDERSTAND AUDIENCES THROUGH STATISTICS OR COMBINATIONS OF DATA FROM DIFFERENT SOURCES 454 PARTNERS CAN USE THIS PURPOSE Switch Label Reports can be generated based on the combination of data sets (like user profiles, statistics, market research, analytics data) regarding your interactions and those of other users with advertising or (non-advertising) content to identify common characteristics (for instance, to determine which target audiences are more receptive to an ad campaign or to certain contents). View Illustrations Object to Legitimate Interests Remove Objection * DEVELOP AND IMPROVE SERVICES 538 PARTNERS CAN USE THIS PURPOSE Switch Label Information about your activity on this service, such as your interaction with ads or content, can be very helpful to improve products and services and to build new products and services based on user interactions, the type of audience, etc. This specific purpose does not include the development or improvement of user profiles and identifiers. View Illustrations Object to Legitimate Interests Remove Objection * USE LIMITED DATA TO SELECT CONTENT 127 PARTNERS CAN USE THIS PURPOSE Switch Label Content presented to you on this service can be based on limited data, such as the website or app you are using, your non-precise location, your device type, or which content you are (or have been) interacting with (for example, to limit the number of times a video or an article is presented to you). View Illustrations Object to Legitimate Interests Remove Objection List of IAB Vendors USE PRECISE GEOLOCATION DATA 258 PARTNERS CAN USE THIS SPECIAL FEATURE Use precise geolocation data With your acceptance, your precise location (within a radius of less than 500 metres) may be used in support of the purposes explained in this notice. List of IAB Vendors ACTIVELY SCAN DEVICE CHARACTERISTICS FOR IDENTIFICATION 125 PARTNERS CAN USE THIS SPECIAL FEATURE Actively scan device characteristics for identification With your acceptance, certain characteristics specific to your device might be requested and used to distinguish it from other devices (such as the installed fonts or plugins, the resolution of your screen) in support of the purposes explained in this notice. List of IAB Vendors ENSURE SECURITY, PREVENT AND DETECT FRAUD, AND FIX ERRORS 507 PARTNERS CAN USE THIS SPECIAL PURPOSE Always Active Your data can be used to monitor for and prevent unusual and possibly fraudulent activity (for example, regarding advertising, ad clicks by bots), and ensure systems and processes work properly and securely. It can also be used to correct any problems you, the publisher or the advertiser may encounter in the delivery of content and ads and in your interaction with them. List of IAB Vendors | View Illustrations DELIVER AND PRESENT ADVERTISING AND CONTENT 501 PARTNERS CAN USE THIS SPECIAL PURPOSE Always Active Certain information (like an IP address or device capabilities) is used to ensure the technical compatibility of the content or advertising, and to facilitate the transmission of the content or ad to your device. List of IAB Vendors | View Illustrations MATCH AND COMBINE DATA FROM OTHER DATA SOURCES 359 PARTNERS CAN USE THIS FEATURE Always Active Information about your activity on this service may be matched and combined with other information relating to you and originating from various sources (for instance your activity on a separate online service, your use of a loyalty card in-store, or your answers to a survey), in support of the purposes explained in this notice. List of IAB Vendors LINK DIFFERENT DEVICES 326 PARTNERS CAN USE THIS FEATURE Always Active In support of the purposes explained in this notice, your device might be considered as likely linked to other devices that belong to you or your household (for instance because you are logged in to the same service on both your phone and your computer, or because you may use the same Internet connection on both devices). List of IAB Vendors IDENTIFY DEVICES BASED ON INFORMATION TRANSMITTED AUTOMATICALLY 487 PARTNERS CAN USE THIS FEATURE Always Active Your device might be distinguished from other devices based on information it automatically sends when accessing the Internet (for instance, the IP address of your Internet connection or the type of browser you are using) in support of the purposes exposed in this notice. List of IAB Vendors Back Button COOKIE LIST Search Icon Filter Icon Clear checkbox label label Apply Cancel Consent Leg.Interest checkbox label label checkbox label label checkbox label label Confirm My Choices