#p2pinfect

September 19, 2026

P2PInfect is back via Redis misconfiguration, not the 2023 Lua sandbox escape. Unit 42 honeypots recorded 692 attacking IPs and 363 C2s from March to August 2026 pushing the worm by issuing SLAVEOF to a rogue master and using RDB writes to plant a crontab entry and an SSH key (Unit 42). · Threat Activity