We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 to review VPN services and cover privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

The Stealth Variant of P2Pinfect Botnet Infects MIPS Devices

The Stealth Variant of P2Pinfect Botnet Infects MIPS Devices
Husain Parvez Published on 6th December 2023 Cybersecurity Researcher

A new variant of the P2Pinfect botnet has been discovered, targeting devices equipped with MIPS (Microprocessor without Interlocked Pipelined Stages) processors. This latest version of the malware, as reported by Cado Security, is specifically compiled for the MIPS architecture, which is commonly used in routers and IoT devices.

The P2Pinfect botnet, initially identified in July 2023 by Palo Alto Networks' Unit 42, was first known for targeting Redis servers by exploiting a critical Lua sandbox escape vulnerability (CVE-2022-0543). The MIPS variant of P2Pinfect, as observed in Cado Security's honeypots, scans for SSH servers using weak credentials to upload the MIPS binary via SFTP and SCP.

This method of propagation is not limited to SSH, as attempts to run the Redis server on MIPS devices through an OpenWRT package named 'redis-server' have also been spotted. According to Cado Security, the new variant is a 32-bit ELF binary with an embedded 64-bit Windows DLL, enabling shell command execution on the host. This variant of P2Pinfect is particularly concerning due to its sophisticated evasion techniques.

It implements a check for the 'TracerPid' value in the process status file to determine if analysis tools are tracing the malware process and terminates if it is. Additionally, it uses system calls to disable Linux core dumps, preventing the dumping of memory contents that contain traces of its activity.

The report also stated the MIPS sample included a new evasion technique, where the MIPS variant of P2Pinfect could detect if it’s being analyzed and would “immediately terminate both the child process and its parent" to evade detection. The continuous development and expansion of P2Pinfect's targeting scope indicate a high level of coding skills and determination from its authors.

However, the precise objectives of the malware's operators remain uncertain. Potential goals could include cryptocurrency mining, launching DDoS attacks, traffic proxying, or executing data theft. The emergence of the MIPS variant of P2Pinfect marks a significant evolution in cyber threats, particularly for devices with MIPS architecture. The sophistication and stealthiness of this variant underscore the need for heightened vigilance and robust security measures in the cybersecurity landscape.

About the Author

Husain Parvez is a Cybersecurity Researcher and News Writer at vpnMentor, focusing on VPN reviews, detailed how-to guides, and hands-on tutorials. Husain is also a part of the vpnMentor Cybersecurity News bulletin and loves covering the latest events in cyberspace and data privacy.

Please, comment on how to improve this article. Your feedback matters!

Leave a comment

Sorry, links are not allowed in this field!

Name should contain at least 3 letters

The field content should not exceed 80 letters

Sorry, links are not allowed in this field!

Please enter a valid email address