FortiGuard Finds Persistent P2Pinfect Infections in GKE and Links Peers to Metro4Shell
Summary
FortiGuard Labs reports persistent P2Pinfect infections in GKE clusters traced to exposed Redis. Telemetry links peers and binaries to Metro4Shell exploitation; RediShell use is a low-confidence possibility. No second-stage payload ran in observed cases.
Key points
- FortiGuard observed P2Pinfect infections in multiple customer GKE clusters, including one lasting six months; the footholds were traced to exposed Redis instances.
- No second-stage payload ran in the observed cases. P2Pinfect can remain dormant, and has been observed elsewhere deploying ransomware or cryptocurrency miners.
- Researchers identified a deployment script that retrieves and runs a UPX-packed Rust P2Pinfect client; decoded arguments revealed bootstrap peer records.
- Peer and binary overlaps led FortiGuard to conclude that P2Pinfect operators likely used CVE-2025-11953 (Metro4Shell) to recruit botnet nodes.
- CVE-2025-49844 (RediShell) is a low-confidence possible access vector; FortiGuard says the infected hosts were vulnerable. CVE-2022-0543 is a confirmed P2Pinfect exploit vector.
- Four exposed Redis nodes were also associated with cryptocurrency miners attributed to a separate React2Shell exploitation campaign.
Article Details
- Attack Vectors
- Exposed Redis instances provided the initial foothold in the observed Google Kubernetes Engine compromises.
- The operators likely began using CVE-2025-11953 (Metro4Shell) to recruit botnet nodes; the article bases this assessment on overlapping peers and payloads.
- CVE-2025-49844 (RediShell) is a possible initial access vector, assessed with low confidence. The infected hosts were vulnerable, but exploitation was not confirmed.
- P2Pinfect is also reported to exploit CVE-2022-0543 and to use Redis SLAVEOF to gain code execution on discovered open nodes.
- P2Pinfect includes a basic SSH password sprayer.
- A shell-based dropper retrieved a P2Pinfect client binary from a remote host and executed it.
- Defensive Notes
- Reduce exposure from misconfigured Redis instances and prioritize patching vulnerabilities that could be exploited on exposed hosts.
- FortiCNAPP is described as identifying misconfigured cloud environments, compromised Redis nodes, and suspicious outbound connections.
- The article recommends monitoring cloud workloads for execution of known-vulnerable code and reviewing the resulting exposure evidence and remediation steps.
- Fortinet says its FortiGate, FortiClient, and FortiEDR products use FortiGuard AntiVirus signatures to detect and prevent the described threats.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 178[.]62[.]63[.]125 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| IPV4 | 47[.]237[.]140[.]12 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| IPV4 | 47[.]83[.]124[.]121 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| IPV4 | 47[.]86[.]33[.]195 | P2Pinfect peer with a Windows client; also identified as payload-hosting infrastructure in the cited VulnCheck report. |
| IPV4 | 47[.]86[.]5[.]176 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| IPV4 | 8[.]210[.]178[.]40 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| IPV4 | 8[.]210[.]50[.]65 | P2Pinfect peer and payload host; the dropper retrieved a client binary from this host. |
| IPV4 | 8[.]218[.]225[.]42 | Identified as a P2Pinfect peer sharing a Linux client binary linked to Metro4Shell exploitation. |
| MD5 | 08ad2c2877edda9a050b81d011c1c003 | MD5 of a Windows P2Pinfect client found on a peer linked to Metro4Shell exploitation. |
| MD5 | 5d1ca537c4bedebf2f4d276d4199ea95 | MD5 of the P2Pinfect client binary written by the deployment script. |
| MD5 | 80676a539765a9e117f20b6b99887eca | MD5 of the P2Pinfect deployment shell script. |
| MD5 | a1a35afebb585917675534de3d610c93 | MD5 of a Linux P2Pinfect client found on peers linked to Metro4Shell exploitation. |
| URL | hxxp[:]//8[.]210[.]50[.]65:60126/linux | P2Pinfect binary download URL used by the deployment dropper. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe client was UPX-packed and executed with a base64-encoded argument blob that was processed through a ChaCha20 stream cipher.T1059.004 · Unix ShellA shell-based deployment script retrieved and launched a P2Pinfect client.T1071.001 · Web ProtocolsThe dropper retrieved the client over HTTP from the reported binary download URL.T1105 · Ingress Tool TransferThe deployment script downloaded a P2Pinfect client binary from a remote host.T1110.003 · Password SprayingThe article says P2Pinfect includes a basic SSH password sprayer.T1190 · Exploit Public-Facing ApplicationThe article reports initial access through exposed Redis instances and links P2Pinfect clients to exploitation of the React Native Metro vulnerability CVE-2025-11953.T1496 · Resource HijackingP2Pinfect has been observed in the wild delivering crypto miners; the article also reports miners on Redis nodes in a separate React2Shell campaign.
CVE
CVE-2022-0543Redis · Redis[Vulnerability identifiers ] Exploitation vectors linked to botnet spread – CVE-2025-11953, CVE-2025-49844, CVE-2022-0543CVE-2025-11953React-native-community · React native community cliThe botnet’s peer infrastructure overlapped with clients linked to CVE-2025-11953, also known as Metro4Shell, expanding its exploitation beyond Redis to React.CVE-2025-49844redis · redisLow-confidence evidence suggests P2Pinfect may also be leveraging CVE-2025-49844, or RediShell, while infected hosts were vulnerable to it.
Malware
Vendors
Products
FortiClientendpoint and network-layer protections are available through Fortinet products including FortiGate, FortiClient, and FortiEDR, all of which utilize the FortiGuard AntiVirus engine for malware detection andFortiCNAPPThe botnet’s beaconing was repeatedly flagged in FortiCNAPP’s Composite Alerts, underscoring how a single misconfiguration can enable long-term compromise in cloud environments.FortiEDRnetwork-layer protections are available through Fortinet products including FortiGate, FortiClient, and FortiEDR, all of which utilize the FortiGuard AntiVirus engine for malware detection and prevention.Fortinet FortiGateAdditional endpoint and network-layer protections are available through Fortinet products including FortiGate, FortiClient, and FortiEDR, all of which utilize the FortiGuard AntiVirus engine for malware detection andFortiSandboxIt aggregates data from Fortinet’s global threat intelligence network, including FortiSandbox, honeypots, CERTs, and trusted partners.FortiWebThe FortiGuard IP Reputation and Anti-Botnet Security Service, available on FortiGate and FortiWeb, blocks known malicious source IPs associated with mining operations, C2 activity, and dropper infrastructure.Google Kubernetes EngineFortiGuard Labs found persistent P2Pinfect infections inside Google Kubernetes Engine clusters, traced back to exposed Redis instances and long-dormant botnet activity that can later deliver miners or ransomware.React Native Metro development serverThese clients were further linked to active exploitation of CVE-2025-11953, a critical unauthenticated remote code execution vulnerability in the React Native Metro development server, publicly designated “Metro4Shell”.RedisFortiGuard Labs found persistent P2Pinfect infections inside Google Kubernetes Engine clusters, traced back to exposed Redis instances and long-dormant botnet activity that can later deliver miners or ransomware.