9/3/25, 7:48 PM

From Dormant to Dangerous: P2Pinfect Evolves to Deploy New Ransomware and Cryptominer reports that P2Pinfect, a Rust-based malware, has progressed from a dormant botnet into a threat that actively deploys ransomware and a cryptominer, mainly targeting Redis servers via a peer-to-peer C2. According to Darktrace, the updated variant includes a user-mode rootkit and the ransomware payload rsagen, with the miner activated after about five minutes and a Monero wallet preconfigured for mining.

The campaign uses a worm-like spread through Redis replication, exploiting SLAVEOF to convert followers into a clone of the leader, and also employs a basic SSH password sprayer, though with limited success. The rsagen ransomware is delivered by a fixed download URL and executes a command to run the binary, and it encrypts files with an appended .encrypted while storing a database of encrypted files in a temporary file.

Victims’ files are potentially ransomable via a decryption token, though the blog notes uncertainty about exactly what is encrypted given Redis’ typical in-memory use. The analysis also highlights the presence of a newly introduced user-mode rootkit that hides the main binary and miner, though the author cautions that Redis’ privileges may limit further impact.