What it is
P2PInfect is a botnet program written in Rust that takes over Redis servers. Infected machines connect to each other directly (peer to peer) rather than to one central server. Reports describe it delivering a cryptocurrency miner and a ransomware payload, which locks files and leaves a note named "Your data has been locked!.txt". The 2024 version adds a rootkit, a tool that hides an attacker's presence, as a library loaded through a line in .bashrc files; it hides its programs, processes and network ports from normal tools, so a server with P2PInfect can't be trusted to check itself.
How it gets in
Through Redis servers reachable from untrusted networks or not updated with security fixes.
Close the door: Keep Redis off untrusted networks and update it to a patched package; Unit 42 names Debian-packaged versions redis/5:6.0.16-1+deb11u2, 5:5.0.14-1+deb10u2, 5:6.0.16-2 and 5:7.0~rc2-2 or newer. Monitor Redis hosts for random file names in /tmp.
How to tell if you have it
Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.
| Kind | Sign |
|---|---|
| File location | /tmp/bash |
| File location | /tmp/rsagen |
| File location | /home/<user>/.lib/libs.so.1 |
| File name | bash |
| File name | libs.so.1 |
| File name | rsagen |
| File name | Your data has been locked!.txt |
| Process name | [kworker/1:0H] |
| Network port | 60100-60150 |
These commands only look. They change nothing.
Look for the known file locations:
sudo ls -la /tmp/bash /tmp/rsagen 2>/dev/nullSearch for the known file names (slow on big disks):
sudo find / -xdev \( -name 'bash' -o -name 'libs.so.1' -o -name 'rsagen' \) 2>/dev/nullList running programs that live in a temporary folder (real software almost never does):
sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'Fingerprint a suspect file and compare it with the list below:
sudo sha256sum /path/to/suspect-fileKnown file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.
How sure these signs are: The 2024 version hides its programs, processes and the network ports 60100 to 60150, so a check run on the infected server can miss it, and finding nothing does not prove the server is clean. The hiding only works for the account whose .bashrc was changed, usually the one Redis runs as, but you still can't rely on the server's own report. bash is the real shell's name, so only /tmp/bash is a sign. [kworker/1:0H] copies a kernel task name; a real one has no program file, so one backed by /tmp/bash is the sign. libs.so.1 has no fixed fingerprint, so match it by name, its .lib folder in a home directory and an LD_PRELOAD line in .bashrc. The main program was rewritten between 2023 and 2024, so older fingerprints may not match. These signs come from 2023 and 2024 reports.
How to deal with it
Removing it in place isn't safe. Here is what to do instead, in order:
- Don't try to clean it in place. Plan to rebuild the server from a fresh install.
- Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence: every .bashrc file in home folders, any .lib/libs.so.1, /tmp/bash and /tmp/rsagen, your authorized_keys files and SSH settings, and the SHA-256 fingerprint of each suspect file. If you can, collect them from a rescue disk.
- Copy off your data: databases and documents. Don't copy programs, shell startup files such as .bashrc, SSH settings or authorized_keys files; any of those could bring it back.
- Reinstall from a fresh image, install all updates, then restore only the data you copied and checked.
- From a clean computer, change every password, SSH key and token that was on the server, including other local users' passwords, and cancel the old ones. Reports say it changes SSH settings, adds its own SSH key and changes other users' passwords, so check those on any server that stays in service.
- Before you reconnect, keep Redis off untrusted networks and update it to a patched version. Keep checking for the signs above, and for random file names in /tmp.
What Minaki Scan does about it
Minaki Scan looks for this threat and reports it only when at least two signs agree. It never tries to remove it: it tells you to back up your data and rebuild.
Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.
Sources
This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.
- SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
- P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm, Palo Alto Networks Unit 42 (2023-07-19)
- From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer, Darktrace (Cado Security) (2024-06-25)