P2PinfectMalware
P2Pinfect is a fast-growing multi platform botnet, the purpose of which is still unknown. Written in Rust, it is compatible with Windows and Linux, including a MIPS variant for Linux based routers and IoT devices.From MISP Galaxy
Last reported 17 days ago, by AhnLab ASEC2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1014Rootkit
“… successfully logging in, the threat actors downloaded and executed ShellBot using wget or curl, and subsequently installed a user-mode rootkit, XHide, and XMRig through a downloader.”
- T1110Brute Force
“The targets were Linux SSH servers accessed through brute force attacks, dictionary attacks, and certain vulnerability exploits.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026“BruteForceAttack CoinMiner DDoS DictionaryAttack Downloader Fisieredoor Gafgyt Honeypot 통계 launcher Linux Mirai P2PInfect Preload Prometei Rootkit XHide XMRig”
-
International Operation Disrupts Sality P2P Botnet“Read more on P2P botnets: Novel Worm-Like Malware P2Pinfect Targets Redis Deployments.”
Indicators in its reports
named in the reports above- hxxp://13.71.2[.]244/.x/xin 1 report
- 103.157.217[.]38in 1 report
- 128.199.127[.]217in 1 report
- 04f5d13f78ca2ab39a8f777885c2a474in 1 report
- 0e3d8bc69fe996dbd681c01f509e8591in 1 report
- 2a9e5e25776fff5430f2dd06335920a4in 1 report
- 3df700b3c1d0ffab386397f4e59c5b23in 1 report
- 5279c09bdabb12a3a28b0db8e838bf1bin 1 report
- hxxp://13.71.2[.]244/.x/pax.txtin 1 report
- 13.71.2[.]244in 1 report
- hxxp://13.71.2[.]244/.x/sys_usersin 1 report
- hxxp://13.71.2[.]244/.x/xmrigroot.tgzin 1 report
- hxxp://177.22.88[.]133:8080/.x/.sys/sys_usersin 1 report
- 177.22.88[.]133in 1 report
- 159.65.54[.]221in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.