Cloud Under Siege: Persistent P2Pinfect Botnet Activity Discovered in Kubernetes Environments

FortiGuard Labs identified a persistent, decentralized P2Pinfect botnet infecting Google Kubernetes Engine clusters by abusing exposed Redis instances and other misconfigurations. The Rust-based, peer-to-peer malware evades sinkholing, supports multiple OSes, uses non-standard ports, and is operated as a botnet-for-hire—enabling third parties to deploy ransomware or crypto-miners. The campaign persisted for months, has broadened initial access vectors (including Metro4Shell and a suspected sandbox escape dubbed RediShell), and the report urges immediate network hardening, patching, traffic monitoring, and deployment audits.