P2PInfect Botnet Compromises Kubernetes Clusters Through Exposed Redis Instances

P2PInfect, a Rust-written P2P botnet active since mid-2023, has been observed compromising Kubernetes clusters (notably GKE) by abusing internet-exposed Redis instances and leveraging CVE-2022-0543 to execute code and enroll hosts into a decentralized mesh; infected nodes remain largely dormant but persistent, increasing the risk of future damaging payloads. FortiGuard Labs recommends not exposing Redis, patching, restricting replication, enforcing strict Kubernetes network policies, auditing outbound connections, and using runtime security tools to detect abnormal container behavior.