Misconfigured, Enrolled and Dormant: Anatomy of a P2Pinfect Kubernetes Compromise

May 20, 2026 · Fortinet Threat Research · Severity: MEDIUM

FortiGuard Labs uncovered a series of compromises involving the P2PInfect botnet targeting Google Kubernetes Engine (GKE) clusters. The attacks exploited misconfigured Redis instances, allowing the botnet to persistently enroll vulnerable systems into its network. Once compromised, the infected clusters remained dormant, posing a latent threat to cloud environments by maintaining a foothold for potential future malicious activity. The P2PInfect botnet primarily affects organizations using GKE with exposed Redis services, highlighting the risks of misconfigured cloud infrastructure. This campaign demonstrates how attackers leverage common configuration errors to establish long-term persistence, enabling them to evade detection while maintaining access for later exploitation. The findings underscore the importance of securing Redis instances and monitoring Kubernetes clusters for unusual activity to prevent similar compromises.

FortiGuard Labs analyzed several P2PInfect compromises in GKE clusters, showing how exposed Redis instances can enable persistent botnet enrollment, dormancy, and cloud runtime risk.