9/2/25, 9:02 PM

A new P2Pinfect variant compiled for the Microprocessor without Interlocked Pipelined Stages (MIPS) architecture has been discovered, according to a Darktrace blog post published on 12 April 2023. Researchers note the MIPS variant targets embedded devices based on 32‑bit MIPS processors and attempts to brute force SSH access, with the aim of infecting routers and IoT devices that use this architecture.

The variant is described as cross‑platform, built in Rust, and involves exploiting Redis in cloud environments, including via an OpenWRT package named redis-server, to facilitate initial access and propagation. An embedded 64‑bit Windows DLL within the MIPS sample acts as a malicious Redis loadable module, mapping shell commands to a Redis handler, and the DLL includes a VM evasion function as identified by researchers.

The analysis highlights updated evasion methods, such as forking to check /proc/self/status for TracerPid and disabling core dumps using prctl and related syscalls to hinder forensics. Claims are made that these features demonstrate a sophisticated threat actor behind P2Pinfect, expanding the botnet’s potential reach across additional processor architectures.