P2Pinfect botnet breaches GKE via unsecured Redis instances

The article discusses the discovery of a P2Pinfect botnet within Google Kubernetes Engine (GKE) clusters, indicating a persistent cloud security threat. Unlike traditional attacks, the botnet exploited simple administrative mistakes, particularly targeting exposed Redis instances to gain initial access. It employs a decentralized architecture that complicates remediation efforts, as it bypasses centralized control servers and uses peer-to-peer communication.

The botnet functions primarily as a platform for hire, allowing external criminals to deploy ransomware or cryptominers. To mitigate risks, recommendations for cloud teams include restricting network access, applying security patches, monitoring for traffic anomalies, and auditing deployment history.