{"vulnerability": "CVE-2022-0543", "sightings": [{"uuid": "82a52f46-79e3-4186-a176-ca96df83c716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2023-06-14T21:10:04.000000Z"}, {"uuid": "608fd674-e410-4b8e-ac13-edd7b600291c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/d69a7ffe-be68-44bc-a40b-4abfc15570cc", "content": "", "creation_timestamp": "2023-07-24T12:59:53.000000Z"}, {"uuid": "8bbbe401-4604-4972-893a-8ada5c923858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971485", "content": "", "creation_timestamp": "2024-12-24T20:30:00.067889Z"}, {"uuid": "cbde26ea-449f-43f2-9ad3-9c58d1db372c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "a42f841b-b181-4068-a90f-f2d11cd81f93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:42.000000Z"}, {"uuid": "0b166bf1-a1e8-48e9-9302-c4ce65bce4c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:10:33.000000Z"}, {"uuid": "515475d7-af11-44e5-b454-e6f542bd5b57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:13:05.000000Z"}, {"uuid": "b7fdc1e5-1880-445c-9112-c9f889e30fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb", "content": "", "creation_timestamp": "2022-04-27T18:37:14.000000Z"}, {"uuid": "9205a25f-f622-47a6-96f6-2bc600bcebfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0e6a012f-794f-4f74-ab36-b38cdbc6e7fd", "content": "", "creation_timestamp": "2026-02-02T12:27:55.109654Z"}, {"uuid": "6aba14c7-10da-4e90-a688-cdf9fa8cf891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/cKure/9268", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2022-0543: Redis sandbox escape affects Debian, Ubuntu, and other derivatives.\n\nhttps://blog.securelayer7.net/redis-sandbox-escape-affects-only-debian-ubuntu-and-other-derivatives/", "creation_timestamp": "2022-04-04T10:31:48.000000Z"}, {"uuid": "358885f2-71b4-45fc-84bb-f2064df43f83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/redis_cve_2022_0543", "content": "", "creation_timestamp": "2023-03-07T05:38:25.000000Z"}, {"uuid": "9d59fcbb-ec3c-49d8-98fe-a84bd36a1231", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1669", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aCVE-2022-0543_RCE,Redis Lua\u6c99\u76d2\u7ed5\u8fc7 \u547d\u4ee4\u6267\u884c\nURL\uff1ahttps://github.com/aodsec/CVE-2022-0543", "creation_timestamp": "2022-03-16T06:44:25.000000Z"}, {"uuid": "3fd3a5d1-940f-4977-9fcc-ba105091a875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/d69a7ffe-be68-44bc-a40b-4abfc15570cc", "content": "", "creation_timestamp": "2026-04-17T00:17:17.000000Z"}, {"uuid": "499a041c-c5ee-4c08-941d-faa5f3a905e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1680", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aRedis\u6c99\u76d2\u9003\u9038\u6f0f\u6d1e\u590d\u73b0(CVE-2022-0543)\nURL\uff1ahttps://github.com/Newbee740/REDIS-CVE-2022-0543\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-03-18T17:21:31.000000Z"}, {"uuid": "60630f5f-5abd-49da-8729-34d5e12f61e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/1679", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aRedis\u6c99\u76d2\u9003\u9038\u6f0f\u6d1e\u590d\u73b0(CVE-2022-0543)\nURL\uff1ahttps://github.com/Newbee740/Redis-CVE-2022-0543-\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-03-18T17:17:12.000000Z"}, {"uuid": "62b2b984-51cb-407e-836d-0d09961de8c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2649", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1aRedis \u6c99\u76d2\u9003\u9038\uff08CVE-2022-0543\uff09POC\nURL\uff1ahttps://github.com/z92g/CVE-2022-0543\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-07-06T18:18:02.000000Z"}, {"uuid": "d7d78316-287c-43f0-933c-12b14217e04b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/BleepingComputer/14560", "content": "\u200aUnpatched Redis servers targeted in new Redigo malware attacks\n\nA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution. [...]\n\nhttps://www.bleepingcomputer.com/news/security/unpatched-redis-servers-targeted-in-new-redigo-malware-attacks/", "creation_timestamp": "2022-12-01T21:01:46.000000Z"}, {"uuid": "9b209b50-b6f9-4e59-8194-420156aca1f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/6431", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aCVE-2022-0543_RCE,Redis Lua\u6c99\u76d2\u7ed5\u8fc7 \u547d\u4ee4\u6267\u884c\nURL\uff1ahttps://github.com/0x7eTeam/CVE-2022-0543\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2024-01-16T03:34:59.000000Z"}, {"uuid": "0493700e-7889-47c5-9fc7-17783475c606", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/60138", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aRCE\n\u63cf\u8ff0\uff1aCVE-2022-0543 - Redis RCE Vulnerability home lab for Red Teaming, Penetration Testing Training with just one DOCKER\nURL\uff1ahttps://github.com/netw0rk7/CVE-2022-0543-Home-Lab\n\n\u6807\u7b7e\uff1a#RCE", "creation_timestamp": "2025-11-19T02:17:31.000000Z"}, {"uuid": "9ef99145-f248-49f8-a9b1-40ad26a2fe42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/itsec_news/3767", "content": "\u200b\u26a1\ufe0f\u0410\u0440\u043c\u0438\u044f \u043a\u043e\u0444\u0435\u0432\u0430\u0440\u043e\u043a \u0430\u0442\u0430\u043a\u0443\u0435\u0442: \u043a\u0430\u043a P2PInfect \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0432\u0430\u0448\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0432 \u0437\u043e\u043c\u0431\u0438-\u0441\u0435\u0442\u044c\n\n\ud83d\udcac \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432 \u043a\u0438\u0431\u0435\u0440\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043d\u043e\u0432\u0443\u044e \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u044e \u0431\u043e\u0442\u043d\u0435\u0442\u0430 P2PInfect. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 Cado Security, \u044d\u0442\u0430 \u0432\u0435\u0440\u0441\u0438\u044f \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b MIPS, \u0447\u0442\u043e \u0434\u0430\u0451\u0442 \u0435\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u0442\u044c \u0440\u043e\u0443\u0442\u0435\u0440\u044b \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0432\u0435\u0449\u0435\u0439 (IoT), \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0443\u043c\u043d\u044b\u0435 \u0447\u0430\u0439\u043d\u0438\u043a\u0438, \u043a\u043e\u0444\u0435\u0432\u0430\u0440\u043a\u0438, IP-\u043a\u0430\u043c\u0435\u0440\u044b \u0438 \u0442.\u043f. \u042d\u0442\u043e \u0440\u0435\u0437\u043a\u043e \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u0444\u0435\u0440\u0443 \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0431\u043e\u0442\u043d\u0435\u0442\u0430.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 P2PInfect, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Rust, \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 \u0438\u044e\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430. \u041e\u043d \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Redis, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u044f\u0437\u044b\u043a\u0430 Lua ( CVE-2022-0543 , \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 10.0) \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430.\n\n\u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043f\u043e\u043a\u0430\u0437\u0430\u043b \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0440\u043e\u0441\u0442 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 P2PInfect \u0432 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u0435 , \u0447\u0442\u043e \u0441\u043e\u0432\u043f\u0430\u043b\u043e \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e. \u042d\u0442\u0438 \u043d\u043e\u0432\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438, \u043f\u043e\u043c\u0438\u043c\u043e \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043c\u0435\u0442\u043e\u0434\u043e\u043c \u043f\u043e\u0434\u0431\u043e\u0440\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 SSH \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u0441 32-\u0431\u0438\u0442\u043d\u044b\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u0430\u043c\u0438 MIPS, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u0443\u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u0442\u0440\u0443\u0434\u043d\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430. \u041f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 SSH-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0431\u044b\u043b\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u043f\u0430\u0440 \u043b\u043e\u0433\u0438\u043d\u043e\u0432 \u0438 \u043f\u0430\u0440\u043e\u043b\u0435\u0439, \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u0432 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b ELF.\n\n\u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u044b SSH \u0438 Redis \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u043c\u0438 \u0432\u0435\u043a\u0442\u043e\u0440\u0430\u043c\u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u0438 P2PInfect, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043d\u0430 MIPS \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 Redis \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e OpenWRT-\u043f\u0430\u043a\u0435\u0442\u0430 \u00abredis-server\u00bb .\n\n\u041e\u0434\u043d\u0438\u043c \u0438\u0437 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043d\u043e\u0432\u043e\u0439 \u0432\u0430\u0440\u0438\u0430\u0446\u0438\u0438 \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0443\u043d\u0438\u0447\u0442\u043e\u0436\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0434\u0430\u043c\u043f\u043e\u0432 \u044f\u0434\u0440\u0430 Linux, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438\u043b\u0438 \u043f\u0440\u0435\u0440\u044b\u0432\u0430\u043d\u0438\u044f \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u0430.\n\n\u0412\u0430\u0440\u0438\u0430\u0446\u0438\u044f MIPS \u0442\u0430\u043a\u0436\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 64-\u0431\u0438\u0442\u043d\u044b\u0439 Windows-\u043c\u043e\u0434\u0443\u043b\u044c DLL \u0434\u043b\u044f Redis, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043d\u0430 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435.\n\n\u0412 Cado Security \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u044e\u0442: \u00ab\u042d\u0442\u043e \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0442\u043e\u043c \u0441\u043c\u044b\u0441\u043b\u0435, \u0447\u0442\u043e \u043e\u043d\u0430 \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u0442 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432, \u0441\u0442\u043e\u044f\u0449\u0438\u0445 \u0437\u0430 P2PInfect, \u043d\u043e \u0438 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0437\u0435\u0446 MIPS32 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u0430\u043c\u0435\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b \u0443\u043a\u043b\u043e\u043d\u0435\u043d\u0438\u044f \u043e\u0442 \u0437\u0430\u0449\u0438\u0442\u044b\u00bb.\n\n\u00ab\u0412 \u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u0438 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c Rust \u0438 \u0431\u044b\u0441\u0442\u0440\u044b\u043c\u0438 \u0442\u0435\u043c\u043f\u0430\u043c\u0438 \u0440\u043e\u0441\u0442\u0430 \u0441\u0430\u043c\u043e\u0433\u043e \u0431\u043e\u0442\u043d\u0435\u0442\u0430, \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u044d\u0442\u0430 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044f \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0432\u0435\u0441\u044c\u043c\u0430 \u0438\u0437\u043e\u0449\u0440\u0435\u043d\u043d\u044b\u043c \u0441\u0443\u0431\u044a\u0435\u043a\u0442\u043e\u043c \u0443\u0433\u0440\u043e\u0437\u044b, \u043b\u0438\u0448\u044c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u044e\u0442\u0441\u044f\u00bb, \u2014 \u043f\u043e\u0434\u044b\u0442\u043e\u0436\u0438\u043b\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438.\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2023-12-04T17:24:01.000000Z"}, {"uuid": "13974d97-2559-49ea-a918-3c2e52099815", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/itsec_news/392", "content": "\u200b\u2694\ufe0f \u0411\u043e\u0442\u043d\u0435\u0442 Muhstik \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis.\n\n\ud83d\udcac \u0411\u043e\u0442\u043d\u0435\u0442 Muhstik, \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c\u044e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 web-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0442\u0435\u043f\u0435\u0440\u044c \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis. \u041e\u043d \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0432 Lua (CVE-2022-0543). \u0423 \u043d\u0435\u0451 10 \u0438\u0437 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u043f\u043e \u0448\u043a\u0430\u043b\u0435 \u043e\u0446\u0435\u043d\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u2014 \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u041f\u041e.\n\n\u041a\u0430\u043a \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Ubuntu, \u00ab\u0438\u0437-\u0437\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u0438\u043c\u0435\u044e\u0449\u0438\u0439 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u043a\u0440\u0438\u043f\u0442\u044b Lua, \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u0443 Lua \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435\u00bb.\n\n\u0412\u043f\u0435\u0440\u0432\u044b\u0435 \u0437\u0430\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u043e\u0439 \u0418\u0411-\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Netlab 360 \u0431\u043e\u0442\u043d\u0435\u0442 Muhstik \u0430\u043a\u0442\u0438\u0432\u0435\u043d \u0441 \u043c\u0430\u0440\u0442\u0430 2018-\u0433\u043e \u0433\u043e\u0434\u0430 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0438\u044f DDoS-\u0430\u0442\u0430\u043a.\n\n#\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u0425\u0430\u043a\u0435\u0440\u044b  #\u0411\u043e\u0442\u043d\u0435\u0442\n\n\ud83d\udd14 ITsec NEWS", "creation_timestamp": "2022-03-29T07:27:53.000000Z"}, {"uuid": "d762d736-bbf1-420c-8e5e-acc72e8fa82d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/kasperskyb2b/763", "content": "\ud83d\udc68\u200d\ud83d\udcbb \u0418\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 APT-\u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0434\u0435\u043b\u0438\n\n\ud83d\udee0  TTP \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0430 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u044b\u0435 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u043e\u0442 Kaspersky ICS CERT. \u0426\u0435\u043b\u044c\u044e \u0430\u0442\u0430\u043a \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u043b\u0433\u043e\u0441\u0440\u043e\u0447\u043d\u0430\u044f \u043a\u0440\u0430\u0436\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043e\u0441\u043e\u0431\u044b\u043c \u0430\u043a\u0446\u0435\u043d\u0442\u043e\u043c \u043d\u0430 \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u0437 \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c.\n\n\u27a1\ufe0f\u0410\u043d\u0430\u043b\u0438\u0437 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u043e\u0432 \u0412\u041f\u041e, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 CVE-2023-23397 \u0432 Outlook. \u041f\u0435\u0440\u0432\u044b\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u0446\u044b \u0434\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0430\u0436 \u043c\u0430\u0440\u0442\u043e\u043c 2022, \u0442\u043e \u0435\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u0433\u043e\u0434. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u0440\u0430\u0437\u043d\u043e\u043e\u0431\u0440\u0430\u0437\u0438\u0435 \u0436\u0435\u0440\u0442\u0432 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0437\u043b\u043e\u043c\u0430\u043d\u043d\u044b\u0445 \u0440\u043e\u0443\u0442\u0435\u0440\u043e\u0432 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0444\u0430\u043b\u044c\u0448\u0438\u0432\u044b\u0445 SMB-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432, \u0443\u0447\u0430\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0445 \u0432 \u0430\u0442\u0430\u043a\u0435.\n\n\ud83c\udde8\ud83c\uddf3 \u041e\u0431\u0437\u043e\u0440 \u0442\u0430\u043a\u0442\u0438\u043a \u043a\u0438\u0442\u0430\u0439\u0441\u043a\u0438\u0445 APT, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0441\u043a\u0440\u044b\u0442\u043d\u043e\u0441\u0442\u0438. \u0410\u0442\u0440\u0438\u0431\u0443\u0446\u0438\u044e \u043e\u0441\u0442\u0430\u0432\u0438\u043c \u043d\u0430 \u0441\u043e\u0432\u0435\u0441\u0442\u0438 Mandiant, \u043d\u043e \u0441\u0430\u043c\u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u043e\u0447\u0435\u043d\u044c \u043f\u043e\u0443\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435. \u0412\u043e \u00ab\u0444\u043b\u0430\u0433\u043c\u0430\u043d\u0441\u043a\u043e\u043c\u00bb \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435 \u0438\u0437 \u044d\u0442\u043e\u0433\u043e \u043e\u0442\u0447\u0451\u0442\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u043b\u0438 \u0441\u0432\u043e\u0451 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0432 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u0443\u044e\u0449\u0435\u0439 \u0438\u0445 \u0441\u0435\u0442\u0438 \u0432\u0441\u0435\u0433\u043e \u0434\u0432\u0443\u043c\u044f \u0432\u0438\u0434\u0430\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432:  \u0436\u0435\u043b\u0435\u0437\u043a\u0430\u043c\u0438 Fortinet \ud83d\ude40 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 VMWare vCenter.  \u041c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u0443\u0436\u0435 \u043d\u0435\u043f\u043b\u043e\u0445\u043e \u0435\u0433\u043e \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u0435\u0442, \u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0431\u043e\u0442\u043d\u0435\u0442\u044b \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u043a\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\ud83d\udc0d \u0410\u043d\u0430\u043b\u0438\u0437 \u0447\u0435\u0440\u0432\u044f P2PInfect, \u043f\u043e\u0440\u0430\u0436\u0430\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis. \u0414\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u0431\u0435\u0433 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b LUA, CVE-2022-0543 \u0441\u043e \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u043c CVSS 10.0.  \u0417\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0441\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043c\u0430\u0439\u043d\u0438\u043d\u0433\u0430, \u043d\u043e \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u043b\u0435\u0433\u043a\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u043f\u043e\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0434\u043b\u044f \u0434\u0440\u0443\u0433\u0438\u0445 \u0446\u0435\u043b\u0435\u0439.\n\n\ud83c\udfa9 \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0430\u043d\u0430\u043b\u0438\u0437 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 Sardonic, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0433\u043e \u0433\u0440\u0443\u043f\u043f\u043e\u0439 FIN8/Syssphinx \u0432\u043e \u0432\u0440\u0435\u043c\u044f ransomware-\u0430\u0442\u0430\u043a \u0438, \u0441\u0443\u0434\u044f \u043f\u043e \u0432\u0441\u0435\u043c\u0443, \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u0433\u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u043f\u0440\u0435\u0434\u0430\u043d\u043d\u044b\u0435 \u0433\u043b\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043b\u0451\u0433\u043a\u0438\u0435 \u0432 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0438 \u0434\u0435\u0442\u0430\u043b\u0438 \u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u044b.  \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0431\u0449\u0438\u0435 TTP \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 \u043c\u0430\u043b\u043e \u0438\u0437\u043c\u0435\u043d\u0438\u043b\u0438\u0441\u044c.\n\n\ud83d\udcbb \u0421\u0430\u0433\u0430 \u0441\u043e \u0432\u0437\u043b\u043e\u043c\u043e\u043c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Microsoft \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f.  \u041a\u0430\u043a \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u043e\u0441\u044c, \u0434\u0435\u0444\u0435\u043a\u0442 \u0432 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e \u0441 \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u043c  MSA-\u043a\u043b\u044e\u0447\u043e\u043c \u0434\u0430\u0432\u0430\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0432\u043e\u0439\u0442\u0438 \u0432 \u043b\u044e\u0431\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f Azure AD, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0441 Micorosoft OpenID 2.0, \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043f\u043e\u0447\u0442\u0443. \u0422\u043e \u0435\u0441\u0442\u044c \u0438 Sharepoint, \u0438 Onedrive, \u0438 Teams,  \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u044e Login with Microsoft. \u0418\u0437 \u0431\u043e\u043b\u0435\u0435 \u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0445 \u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439: Microsoft \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0432\u0441\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043a\u043b\u044e\u0447\u0435\u0439, \u043f\u0435\u0440\u0435\u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0432\u0441\u0435 MSA-\u043a\u043b\u044e\u0447\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u043b\u043e\u0433\u0438, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c. \u0421\u0443\u0434\u044f \u043f\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0420\u0435\u0434\u043c\u043e\u043d\u0434\u0443  TI, Storm-0558 \u0441\u043c\u0435\u043d\u0438\u043b\u0438 \u0441\u0432\u043e\u0438 \u0442\u0430\u043a\u0442\u0438\u043a\u0438 \u0438, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0434\u0440\u0443\u0433\u0438\u0445 \u043a\u043b\u044e\u0447\u0435\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0443 \u043d\u0438\u0445 \u043d\u0435\u0442.\n\n\ud83e\udd5aLookout \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u0448\u043f\u0438\u043e\u043d\u0441\u043a\u0438\u0435 \u0438\u043c\u043f\u043b\u0430\u043d\u0442\u044b WyrmSpy and DragonEgg \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0435 APT41 (\u043a\u043b\u0430\u0441\u0442\u0435\u0440 Winnti). \u042d\u0442\u0438 \u043e\u0431\u0440\u0430\u0437\u0447\u0438\u043a\u0438 \u0412\u041f\u041e \u0434\u043b\u044f Android \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b \u0434\u0430\u0432\u043d\u043e, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u044b\u043b\u0435\u0441\u043e\u0441\u0438\u0442\u044c \u0441 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430 \u0432\u0441\u0451 \u043c\u0430\u043b\u043e-\u043c\u0430\u043b\u044c\u0441\u043a\u0438 \u0446\u0435\u043d\u043d\u043e\u0435 \u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0436\u0435\u0440\u0442\u0432\u0430\u043c \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430\u043c\u0438 \u0441\u043e\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0438\u0438. \u041d\u043e\u0432\u043e\u0435 \u0432 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u2014 \u043d\u0430\u0439\u0434\u0435\u043d\u043d\u044b\u0435 \u043f\u0435\u0440\u0435\u0441\u0435\u0447\u0435\u043d\u0438\u044f \u04212-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b.\n\n #\u0434\u0430\u0439\u0436\u0434\u0435\u0441\u0442 #APT @\u041f2\u0422", "creation_timestamp": "2023-07-24T09:16:32.000000Z"}, {"uuid": "43ca0cf9-4cd2-4710-9a4f-16d6ccd5f461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "Telegram/1FFdKQsIhhHIcNNM6vHDB5JafqK5ovdzqF5AKutNoCX9TPCd", "content": "", "creation_timestamp": "2025-01-30T02:17:49.000000Z"}, {"uuid": "0ae11c82-dff4-43d3-8222-a308e88a9ebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "Telegram/X_HGgbIgikk0LaQ6yf0_-ZBrJE_Y78HzRvTlL5SRdqdjPwc", "content": "", "creation_timestamp": "2023-07-20T16:03:51.000000Z"}, {"uuid": "717283fd-30f8-45ca-bf9a-a35573848862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/arpsyndicate/1140", "content": "#ExploitObserverAlert\n\nCVE-2022-0543\n\nDESCRIPTION: Exploit Observer has 42 entries related to CVE-2022-0543. It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.\n\nFIRST-EPSS: 0.971030000\nNVD-IS: 6.0\nNVD-ES: 3.9", "creation_timestamp": "2023-12-04T06:57:46.000000Z"}, {"uuid": "9d15f786-cf09-4154-b81a-008cd0b22bac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/true_secator/4638", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Palo Alto Networks Unit 42 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043e\u0434\u043d\u043e\u0440\u0430\u043d\u0433\u043e\u0432\u043e\u0433\u043e (P2P) \u0447\u0435\u0440\u0432\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c\u00a0P2PInfect, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis \u0434\u043b\u044f \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u041d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0439 \u043d\u0430 Rust P2PInfect \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043a\u0430\u043a \u0432 \u041e\u0421 Linux, \u0442\u0430\u043a \u0438 \u0432 Windows, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442 \u0435\u0433\u043e \u0431\u043e\u043b\u0435\u0435 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0438 \u0431\u043e\u043b\u0435\u0435 \u043c\u043e\u0449\u043d\u044b\u043c, \u043d\u0435\u0436\u0435\u043b\u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u0447\u0435\u0440\u0432\u0438.\n\n\u041f\u043e \u043e\u0446\u0435\u043d\u043a\u0430\u043c, \u0434\u043e 934 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Redis \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b \u0434\u043b\u044f \u044d\u0442\u043e\u0439 \u0443\u0433\u0440\u043e\u0437\u044b.\u00a0\u041f\u0435\u0440\u0432\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 P2PInfect \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d 11 \u0438\u044e\u043b\u044f 2023 \u0433\u043e\u0434\u0430.\n\n\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440\u0438\u0441\u0442\u0438\u043a\u043e\u0439 \u0447\u0435\u0440\u0432\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0435\u0433\u043e \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0440\u0430\u0436\u0430\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Redis, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b Lua.\n\nCVE-2022-0543\u00a0\u0438\u043c\u0435\u0435\u0442 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS: 10,0 \u0438 \u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445\u00a0\u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Muhstik, Redigo \u0438 HeadCrab, \u0437\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0439 \u0433\u043e\u0434.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 - \u0434\u0440\u043e\u043f\u043f\u0435\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 P2P-\u0441\u0432\u044f\u0437\u044c \u0441 \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u041f\u041e \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u0445\u043e\u0441\u0442\u044b Redis \u0438 SSH.\n\n\u0417\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 \u0437\u0430\u0442\u0435\u043c \u043f\u0440\u0438\u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u0442\u0441\u044f \u043a \u0441\u0435\u0442\u0438 P2P, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0440\u0443\u0433\u0438\u043c \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u043c \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0430\u043c \u0434\u043b\u044f \u0431\u0443\u0434\u0443\u0449\u0438\u0445 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 Redis.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0445\u043e\u0441\u0442\u043e\u043c \u0438 P2P-\u0441\u0435\u0442\u044c\u044e, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f.\n\n\u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432\u0430\u0440\u0438\u0430\u043d\u0442 P2PInfect \u0434\u043b\u044f Windows \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432 \u0441\u0435\u0431\u044f \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 Monitor \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u043a\u0430\u043a\u043e\u0432\u0430 \u043a\u043e\u043d\u0435\u0447\u043d\u0430\u044f \u0446\u0435\u043b\u044c \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 Unit 42 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0442 \u0447\u0435\u0442\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u044f \u043c\u0430\u0439\u043d\u0435\u0440\u0430 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u041d\u043e, \u043a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f, \u0435\u0449\u0435 \u0432\u0435\u0447\u0435\u0440.", "creation_timestamp": "2023-07-20T13:10:04.000000Z"}, {"uuid": "64050eb8-89dc-4cae-a96d-f04471337592", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/intelexch/19963", "content": "https://github.com/JacobEbben/CVE-2022-0543", "creation_timestamp": "2022-09-07T15:28:53.000000Z"}, {"uuid": "fa24820b-b13d-4be7-af95-088ed23909e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/true_secator/3782", "content": "\u0421\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u044b \u0438\u0437 AquaSec \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043d\u043e\u0432\u043e\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Go, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u0435 \u0432 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u043c\u0443\u044e \u043a\u0430\u043a CVE-2022-0543.\n\nRedis (Remote Dictionary Server) \u2014 \u044d\u0442\u043e \u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u043a\u043b\u0430\u0441\u0441\u0430 NoSQL \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c. \u0422\u0430\u043a \u043a\u0430\u043a \u043c\u0430\u043b\u0432\u0430\u0440\u044c \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0430 \u043d\u0430 Golang \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis, \u043e\u043d\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Redigo.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-0543 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u044b Debian \u0438 Linux, \u0438\u043c\u0435\u0435\u0442 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 10 \u0431\u0430\u043b\u043b\u043e\u0432 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 Lua \u0441 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435. \n\n\u0415\u0449\u0435 \u0432 \u043c\u0430\u0440\u0442\u0435 2022 \u0433\u043e\u0434\u0430 \u0431\u0430\u0433\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 CISA \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u041e\u0434\u043d\u0430\u043a\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0435\u0435 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u0437-\u0437\u0430 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0438\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430 .\n\n\u041e\u0431\u044b\u0447\u043d\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u0430\u0442\u0430\u043a \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Redis, \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432 6379 \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435, \u0430 \u043f\u043e\u0441\u043b\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c\u0441\u044f \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b Redis:\n\n- INFO  \u2014 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u0432\u0435\u0440\u0441\u0438\u0438 Redis, \u0447\u0442\u043e\u0431\u044b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c, \u0443\u044f\u0437\u0432\u0438\u043c \u043b\u0438 \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043b\u044f CVE-2022-0543;\n- SLAVEOF \u2014 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0435 \u043a\u043e\u043f\u0438\u0438 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430;\n- REPLCONF \u2014 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a \u0432\u043d\u043e\u0432\u044c \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u043e\u0439 \u0440\u0435\u043f\u043b\u0438\u043a\u0435;\n- PSYNC \u2014 \u0438\u043d\u0438\u0446\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f \u043f\u043e\u0442\u043e\u043a\u0430 \u0440\u0435\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 exp_lin.so \u043d\u0430 \u0434\u0438\u0441\u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430;\n- MODULE LOAD \u2014 \u043c\u043e\u0434\u0443\u043b\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0437 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c CVE-2022-0543 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b;\n- SLAVEOF NO ONE \u2014 \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0440\u0435\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Redis \u0432 \u043c\u0430\u0441\u0442\u0435\u0440.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u044d\u043a\u0434\u043e\u0440\u0430, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431 \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0438 \u0445\u043e\u0441\u0442\u0430, \u0430 \u0437\u0430\u0442\u0435\u043c \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u044e\u0442 Redigo (redis-1.2-SNAPSHOT).\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u043e\u0441\u043b\u0435 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0434\u0430\u043b\u0435\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0442 \u043e\u0431\u044b\u0447\u043d\u0443\u044e \u0441\u0432\u044f\u0437\u044c Redis \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0440\u0442 6379, \u0447\u0442\u043e\u0431\u044b \u0438\u0437\u0431\u0435\u0436\u0430\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u043f\u044b\u0442\u0430\u044f\u0441\u044c \u0441\u043a\u0440\u044b\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f Redigo.\n\n\u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e Redigo \u0434\u043b\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u0438\u044f Redis \u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0435\u0433\u043e \u0432 \u0431\u043e\u0442\u043d\u0435\u0442, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0439 \u0434\u043b\u044f DDoS-\u0430\u0442\u0430\u043a, \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043c\u0430\u0439\u043d\u0435\u0440\u043e\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0438\u043b\u0438 \u043a\u0440\u0430\u0436\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432.\n\n\u0412 \u0446\u0435\u043b\u044f\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u043b\u0432\u0430\u0440\u0438 AquaSec \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0438 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 (IOC).", "creation_timestamp": "2022-12-05T08:32:41.000000Z"}, {"uuid": "88312555-f293-4d04-8e54-9b31f1dea8c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/2374", "content": "CVE-2022-0543 Technical Analysis https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis", "creation_timestamp": "2026-08-03T00:06:22.281661Z"}, {"uuid": "475ab1ba-72f3-4010-a01d-a60e2e472cc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cibsecurity/37758", "content": "\u203c CVE-2022-0543 \u203c\n\nIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-02-18T22:40:51.000000Z"}, {"uuid": "f264407f-9faf-42ad-a3a6-e8cbb9038838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/thehackernews/2016", "content": "Muhstik botnet is targeting Redis servers using a recently disclosed highly critical vulnerability (CVE-2022-0543 / CVSS 10.0) in the database system.\n\nRead details: https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html", "creation_timestamp": "2022-03-28T09:15:09.000000Z"}, {"uuid": "416adae3-1af4-4874-85e4-0ea3f87d6c53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/zatelecom/27550", "content": "\u041e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f, \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0437\u0443\u0431\u043d\u044b\u0435 \u0449\u0435\u0442\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0430\u0442\u0430\u043a\u043e\u0432\u0430\u043d\u044b. \u041d\u043e \u0438 \u0442\u0435\u043b\u044f\u0447\u0438\u0435 \u043e\u0448\u0435\u0439\u043d\u0438\u043a\u0438:\n\nhttps://dl.acm.org/doi/10.1145/3605758.3623498\n\n... \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0438\u0437 \u043e\u0448\u0435\u0439\u043d\u0438\u043a\u043e\u0432 \u0441\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u0442\u0447\u0438\u043a\u0430\u043c\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043a\u0430\u0436\u0434\u044b\u0435 5 \u043c\u0438\u043d\u0443\u0442 \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0434\u0432\u0438\u0433\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0440\u043e\u0432 \u043d\u0430 \u043f\u0440\u0438\u0451\u043c\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u043e \u0440\u0430\u0434\u0438\u043e\u0441\u0438\u0433\u043d\u0430\u043b\u0443 \u043d\u0430 \u0447\u0430\u0441\u0442\u043e\u0442\u0435 434 \u041c\u0413\u0446. \u042d\u0442\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441\u043e \u0437\u0434\u043e\u0440\u043e\u0432\u044c\u0435\u043c \u043c\u043b\u0435\u043a\u043e\u043f\u0438\u0442\u0430\u044e\u0449\u0438\u0445.\n\u0412 \u0445\u043e\u0434\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b \u0431\u0435\u0441\u043f\u0440\u043e\u0432\u043e\u0434\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u043c\u043e\u0439 \u0440\u0430\u0434\u0438\u043e\u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0441\u043c\u043e\u0433\u043b\u0438 \u0443\u0441\u043f\u0435\u0448\u043d\u043e \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0434\u0435\u043c\u043e\u0434\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0438\u0433\u043d\u0430\u043b \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u041d\u043e \u044d\u0442\u043e \u0444\u0438\u0433\u043d\u044f \u2014 \u0442\u0443\u0442 \u043f\u0440\u043e\u0441\u0442\u043e \u0432\u0437\u043b\u043e\u043c \u0440\u0430\u0434\u0438\u043e\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430.\n\n\u0410 \u0432\u043e\u0442 \u043a\u0430\u043a \u0432\u0430\u043c \u0431\u043e\u0442\u043d\u0435\u0442 \u0438\u0437 \u0417\u041e\u041c\u0411\u0418-\u041a\u041e\u0424\u0415\u0412\u0410\u0420\u041e\u041a??\n\nhttps://www.cadosecurity.com/p2pinfect-new-variant-targets-mips-devices/\n\n\u0421 \u0438\u044e\u043b\u044f 2023 \u0433\u043e\u0434\u0430 Cado Security Labs \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0438 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e \u0431\u044b\u0441\u0442\u0440\u043e\u043c \u0440\u043e\u0441\u0442\u0435 \u043a\u0440\u043e\u0441\u0441\u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u043e\u0442\u043d\u0435\u0442\u0430 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c P2Pinfect. \u041a\u0430\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0438\u0437 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u044f, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0430, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u0430\u044f \u043d\u0430 Rust, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043a\u0430\u043a \u0430\u0433\u0435\u043d\u0442 \u0431\u043e\u0442\u043d\u0435\u0442\u0430, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u044f \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0435 \u0445\u043e\u0441\u0442\u044b \u0432 \u043e\u0434\u043d\u043e\u0440\u0430\u043d\u0433\u043e\u0432\u043e\u0439 \u0442\u043e\u043f\u043e\u043b\u043e\u0433\u0438\u0438. \u0412 \u0440\u0430\u043d\u043d\u0438\u0445 \u043e\u0431\u0440\u0430\u0437\u0446\u0430\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u043e Redis \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u2014 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0430\u0445. \n\n\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Redis, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f P2Pinfect. \u041a \u043d\u0438\u043c \u043e\u0442\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f CVE-2022-0543 \u2014 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0432 \u044f\u0437\u044b\u043a\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0435\u0432 LUA (\u043e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0441\u043e\u043e\u0431\u0449\u0438\u043b Unit42 ) \u0438, \u043a\u0430\u043a \u0440\u0430\u043d\u0435\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u043b\u043e Cado Security Labs, \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0430\u0442\u0430\u043a\u0430 \u0440\u0435\u043f\u043b\u0438\u043a\u0430\u0446\u0438\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044f Redis.  \n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Cado Security Labs \u0441 \u0442\u0435\u0445 \u043f\u043e\u0440 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043d\u043e\u0432\u044b\u043c \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e \u043d\u0430 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 \u043d\u0430 \u0431\u0430\u0437\u0435 32-\u0431\u0438\u0442\u043d\u044b\u0445 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 MIPS \u0438 \u043f\u044b\u0442\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u0432\u0437\u043b\u043e\u043c\u0430\u0442\u044c SSH-\u0434\u043e\u0441\u0442\u0443\u043f \u043a \u044d\u0442\u0438\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c. \u0412\u0435\u0441\u044c\u043c\u0430 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0447\u0442\u043e, \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u044f\u0441\u044c \u043d\u0430 MIPS, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 P2Pinfect \u043d\u0430\u043c\u0435\u0440\u0435\u0432\u0430\u044e\u0442\u0441\u044f \u0437\u0430\u0440\u0430\u0437\u0438\u0442\u044c \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u044b \u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 IoT \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u041f\u041e. \u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0440\u043e\u0432 MIPS \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0431\u044b\u0447\u043d\u044b\u043c \u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f \u0432\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0438 \u044d\u0442\u0430 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u0430 \u0440\u0430\u043d\u0435\u0435 \u0431\u044b\u043b\u0430 \u0446\u0435\u043b\u044c\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u0431\u043e\u0442\u043d\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0442\u0430\u043a\u0438\u0435 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0435 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432\u0430, \u043a\u0430\u043a Mirai \u0438 \u0438\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u044b/\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u043d\u044b\u0435.", "creation_timestamp": "2024-02-07T18:39:29.000000Z"}, {"uuid": "c7117782-143e-4a36-b607-cdc6d86a4fbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/CNArsenal/2031", "content": "https://github.com/0x7eTeam/CVE-2022-0543\n\nCVE-2022-0543_RCE,Redis Lua\u6c99\u76d2\u7ed5\u8fc7 \u547d\u4ee4\u6267\u884c\n#github #exploit", "creation_timestamp": "2024-02-25T12:19:31.000000Z"}, {"uuid": "b33029f1-9b8e-4604-942d-6f95a181eb83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/797", "content": "https://github.com/vulhub/vulhub/blob/master/redis/CVE-2022-0543/README.md\n\neval 'local io_l = package.loadlib(\"/usr/lib/x86_64-linux-gnu/liblua5.1.so.0\", \"luaopen_io\"); local io = io_l(); local f = io.popen(\"id\", \"r\"); local res = f:read(\"*a\"); f:close(); return res' 0\n\ncve-2022-0543  poc\n#github #poc", "creation_timestamp": "2023-08-01T07:41:50.000000Z"}, {"uuid": "a6f26d6c-791a-412a-ba7f-1f795e7a4380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/5581", "content": "#exploit\n1. CVE-2022-0543:\nRedis Lua Sandbox Escape and RCE\nhttps://github.com/vulhub/vulhub/blob/master/redis/CVE-2022-0543/README.md\n\n2. Exploiting CVE-2021-26708 (Linux kernel) with sshd\nhttps://hardenedvault.net/2022/03/01/poc-cve-2021-26708.html", "creation_timestamp": "2022-03-11T11:00:52.000000Z"}, {"uuid": "6a143dbe-9663-46ee-a09b-7e658d25ce1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/2088", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-0543\nGithub: https://github.com/JacobEbben/CVE-2022-0543\nDescribe: \nIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "creation_timestamp": "2026-08-02T00:01:17.469277Z"}, {"uuid": "0decdf7e-9531-497e-97cb-5199bd4afbb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/CVEhub/2088", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-0543\nGithub: https://github.com/JacobEbben/CVE-2022-0543\nDescribe: \nIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "creation_timestamp": "2026-08-01T04:00:04.287492Z"}, {"uuid": "54fe64d1-b59f-48ac-a090-007f52ba44f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mmhaduvcc324", "content": "P2PInfect botnet targets Kubernetes clusters via exposed Redis instances, exploiting CVE-2022-0543. Secure your cloud environments now! #CyberSecurity #Kubernetes #Redis #P2PInfect #CloudSecurity Link: thedailytechfeed.com/p2pinfect-bo...", "creation_timestamp": "2026-05-22T15:21:04.434256Z"}, {"uuid": "c75ca9ff-4750-42e2-9b8b-90ffc9ecf727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "MISP/d277e10b-ad25-4081-a3b6-165ec062d019", "content": "", "creation_timestamp": "2026-05-26T07:46:11.000000Z"}, {"uuid": "ba5138eb-aaa2-4055-83d6-1f37d82153dd", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a469476e-6b8b-4fa2-9a34-558f0c089004", "content": "", "creation_timestamp": "2026-06-19T12:47:20.929421Z"}, {"uuid": "fdb32094-98d2-468e-8641-077cc03fa89c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0a845954-c0bc-48fa-95cd-4bad31429452", "content": "", "creation_timestamp": "2026-06-23T14:05:16.318764Z"}, {"uuid": "67105b2c-c9f6-4a9f-8ffc-f13aceb6ba32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/GithubRedTeam/89699", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-0543\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:22:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2022-0543 \u2013 Redis Remote Code Execution (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:22.535303Z"}, {"uuid": "27668180-09bc-425e-971a-be7ee917cc27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/GithubRedTeam/89699", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-0543\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:22:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2022-0543 \u2013 Redis Remote Code Execution (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:38.337514Z"}, {"uuid": "51eb68bb-5583-474a-becb-7c2cd07e6a08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/89699", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC #Remote Code Execution\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2022-0543\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a K3ysTr0K3R\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-19 21:22:09\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2022-0543 \u2013 Redis Remote Code Execution (RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:18.145325Z"}, {"uuid": "09785062-73cd-48ad-8017-279d1bdbd5e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/EchelonEyes/1766", "content": "\u0427\u0435\u0440\u0432\u044c P2PInfect \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux \u0438 Windows\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Palo Alto Networks \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0447\u0435\u0440\u0432\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c P2PInfect, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b. \u041f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0447\u0435\u0440\u0432\u044f\u043c\u0438, P2PInfect \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0430\u0441\u0435\u043d, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043a\u0430\u043a \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux, \u0442\u0430\u043a \u0438 \u0432 Windows. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u043d \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Rust \u2013 \u0445\u043e\u0440\u043e\u0448\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u0438 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0434\u043e 934 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Redis. \u041f\u0435\u0440\u0432\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 P2PInfect \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d 11 \u0438\u044e\u043b\u044f 2023 \u0433\u043e\u0434\u0430.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Redis, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b Lua - CVE-2022-0543 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0). \u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u043e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Muhstik, Redigo \u0438 HeadCrab.\n \n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043e\u0434\u043d\u043e\u0440\u0430\u043d\u0433\u043e\u0432\u0443\u044e (P2P) \u0441\u0432\u044f\u0437\u044c \u0441 \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e P2P \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 Redis- \u0438 SSH-\u0445\u043e\u0441\u0442\u044b.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0445\u043e\u0441\u0442\u043e\u043c \u0438 P2P-\u0441\u0435\u0442\u044c\u044e, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432\u0435\u0440\u0441\u0438\u044f P2PInfect \u0434\u043b\u044f Windows \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u00abMonitor\u00bb \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u043a\u0442\u043e \u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430 \u0434\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u0438 \u043a\u0430\u043a\u043e\u0432\u0430 \u0446\u0435\u043b\u044c \u0445\u0430\u043a\u0435\u0440\u043e\u0432. \u041a\u043e\u043c\u0430\u043d\u0434\u0430 Unit 42 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0442 \u0447\u0435\u0442\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u043b\u043e\u0432\u0430 \u00ab\u043c\u0430\u0439\u043d\u0435\u0440\u00bb \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u00ab\u0427\u0435\u0440\u0432\u044c P2PInfect, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u0445\u043e\u0440\u043e\u0448\u043e \u0441\u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438. \u2013 \u041f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u0435 P2P-\u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2014 \u044d\u0442\u043e \u043d\u0435 \u0442\u043e, \u0447\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0440\u0435\u0434\u0435 \u0443\u0433\u0440\u043e\u0437 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043e\u0431\u043b\u0430\u043a\u043e \u0438\u043b\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/ \n\n#\u0447\u0435\u0440\u0432\u044c #\u043e\u0431\u043b\u0430\u043a\u043e #Redis #\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e", "creation_timestamp": "2026-07-26T02:02:24.633151Z"}, {"uuid": "d3c8c515-db68-410e-b3c5-51adb67ab1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/EchelonEyes/1766", "content": "\u0427\u0435\u0440\u0432\u044c P2PInfect \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux \u0438 Windows\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Palo Alto Networks \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0447\u0435\u0440\u0432\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c P2PInfect, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b. \u041f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0447\u0435\u0440\u0432\u044f\u043c\u0438, P2PInfect \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0430\u0441\u0435\u043d, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043a\u0430\u043a \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux, \u0442\u0430\u043a \u0438 \u0432 Windows. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u043d \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Rust \u2013 \u0445\u043e\u0440\u043e\u0448\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u0438 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0434\u043e 934 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Redis. \u041f\u0435\u0440\u0432\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 P2PInfect \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d 11 \u0438\u044e\u043b\u044f 2023 \u0433\u043e\u0434\u0430.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Redis, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b Lua - CVE-2022-0543 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0). \u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u043e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Muhstik, Redigo \u0438 HeadCrab.\n \n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043e\u0434\u043d\u043e\u0440\u0430\u043d\u0433\u043e\u0432\u0443\u044e (P2P) \u0441\u0432\u044f\u0437\u044c \u0441 \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e P2P \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 Redis- \u0438 SSH-\u0445\u043e\u0441\u0442\u044b.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0445\u043e\u0441\u0442\u043e\u043c \u0438 P2P-\u0441\u0435\u0442\u044c\u044e, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432\u0435\u0440\u0441\u0438\u044f P2PInfect \u0434\u043b\u044f Windows \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u00abMonitor\u00bb \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u043a\u0442\u043e \u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430 \u0434\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u0438 \u043a\u0430\u043a\u043e\u0432\u0430 \u0446\u0435\u043b\u044c \u0445\u0430\u043a\u0435\u0440\u043e\u0432. \u041a\u043e\u043c\u0430\u043d\u0434\u0430 Unit 42 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0442 \u0447\u0435\u0442\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u043b\u043e\u0432\u0430 \u00ab\u043c\u0430\u0439\u043d\u0435\u0440\u00bb \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u00ab\u0427\u0435\u0440\u0432\u044c P2PInfect, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u0445\u043e\u0440\u043e\u0448\u043e \u0441\u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438. \u2013 \u041f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u0435 P2P-\u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2014 \u044d\u0442\u043e \u043d\u0435 \u0442\u043e, \u0447\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0440\u0435\u0434\u0435 \u0443\u0433\u0440\u043e\u0437 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043e\u0431\u043b\u0430\u043a\u043e \u0438\u043b\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/ \n\n#\u0447\u0435\u0440\u0432\u044c #\u043e\u0431\u043b\u0430\u043a\u043e #Redis #\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e", "creation_timestamp": "2026-07-27T00:01:00.107151Z"}, {"uuid": "50c90fc3-be8f-4ed4-923a-a28b5fddb073", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/1766", "content": "\u0427\u0435\u0440\u0432\u044c P2PInfect \u0430\u0442\u0430\u043a\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux \u0438 Windows\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Palo Alto Networks \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u043e\u0433\u043e \u0447\u0435\u0440\u0432\u044f \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c P2PInfect, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b. \u041f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0447\u0435\u0440\u0432\u044f\u043c\u0438, P2PInfect \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u043e \u043e\u043f\u0430\u0441\u0435\u043d, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b Redis, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043a\u0430\u043a \u0432 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Linux, \u0442\u0430\u043a \u0438 \u0432 Windows. \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u043d \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f Rust \u2013 \u0445\u043e\u0440\u043e\u0448\u043e \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u0438\u0440\u0443\u0435\u043c\u043e\u043c \u0438 \u043e\u0440\u0438\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0435 \u0432\u044b\u0447\u0438\u0441\u043b\u0435\u043d\u0438\u044f.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0434\u043e 934 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c Redis. \u041f\u0435\u0440\u0432\u044b\u0439 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440 P2PInfect \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d 11 \u0438\u044e\u043b\u044f 2023 \u0433\u043e\u0434\u0430.\n\n\u0427\u0442\u043e\u0431\u044b \u043f\u043e\u043f\u0430\u0441\u0442\u044c \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b Redis, \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b Lua - CVE-2022-0543 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS: 10,0). \u0420\u0430\u043d\u0435\u0435 \u044d\u0442\u043e\u0442 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u0435\u043c\u0435\u0439\u0441\u0442\u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a Muhstik, Redigo \u0438 HeadCrab.\n \n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u0437\u0430\u0442\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u043e\u0434\u043d\u043e\u0440\u0430\u043d\u0433\u043e\u0432\u0443\u044e (P2P) \u0441\u0432\u044f\u0437\u044c \u0441 \u0431\u043e\u043b\u0435\u0435 \u043a\u0440\u0443\u043f\u043d\u043e\u0439 \u0441\u0435\u0442\u044c\u044e P2P \u0438 \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u0435\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0434\u0432\u043e\u0438\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u043b\u043e\u0432\u0440\u0435\u0434 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 Redis- \u0438 SSH-\u0445\u043e\u0441\u0442\u044b.\n\n\u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 PowerShell \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u0445\u043e\u0441\u0442\u043e\u043c \u0438 P2P-\u0441\u0435\u0442\u044c\u044e, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u0411\u043e\u043b\u0435\u0435 \u0442\u043e\u0433\u043e, \u0432\u0435\u0440\u0441\u0438\u044f P2PInfect \u0434\u043b\u044f Windows \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u00abMonitor\u00bb \u0434\u043b\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u041d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e, \u043a\u0442\u043e \u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430 \u0434\u0430\u043d\u043d\u043e\u0439 \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0435\u0439 \u0438 \u043a\u0430\u043a\u043e\u0432\u0430 \u0446\u0435\u043b\u044c \u0445\u0430\u043a\u0435\u0440\u043e\u0432. \u041a\u043e\u043c\u0430\u043d\u0434\u0430 Unit 42 \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u043d\u0435\u0442 \u0447\u0435\u0442\u043a\u0438\u0445 \u0434\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0441\u043b\u043e\u0432\u0430 \u00ab\u043c\u0430\u0439\u043d\u0435\u0440\u00bb \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u043c \u043a\u043e\u0434\u0435 \u043d\u0430\u0431\u043e\u0440\u0430 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432.\n\n\u00ab\u0427\u0435\u0440\u0432\u044c P2PInfect, \u043f\u043e-\u0432\u0438\u0434\u0438\u043c\u043e\u043c\u0443, \u0445\u043e\u0440\u043e\u0448\u043e \u0441\u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0432\u0430\u0440\u0438\u0430\u043d\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u2014 \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438. \u2013 \u041f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u0435 P2P-\u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u2014 \u044d\u0442\u043e \u043d\u0435 \u0442\u043e, \u0447\u0442\u043e \u043e\u0431\u044b\u0447\u043d\u043e \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0441\u0440\u0435\u0434\u0435 \u0443\u0433\u0440\u043e\u0437 \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043e\u0431\u043b\u0430\u043a\u043e \u0438\u043b\u0438 \u043a\u0440\u0438\u043f\u0442\u043e\u0434\u0436\u0435\u043a\u0438\u043d\u0433\u0430\u00bb.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: https://unit42.paloaltonetworks.com/peer-to-peer-worm-p2pinfect/ \n\n#\u0447\u0435\u0440\u0432\u044c #\u043e\u0431\u043b\u0430\u043a\u043e #Redis #\u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435\u041f\u041e", "creation_timestamp": "2026-07-28T00:00:23.677409Z"}, {"uuid": "9c10afe3-6647-420c-a06c-465514c777fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/CVEhub/2088", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-0543\nGithub: https://github.com/JacobEbben/CVE-2022-0543\nDescribe: \nIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "creation_timestamp": "2026-07-29T12:01:01.817566Z"}, {"uuid": "e4af4678-4886-4260-84d7-5f7ecba14161", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/reverseame/2374", "content": "CVE-2022-0543 Technical Analysis https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis", "creation_timestamp": "2026-07-29T12:02:41.479045Z"}, {"uuid": "6dfad8ab-1f85-447c-ab60-85d1fc401411", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/CVEhub/2088", "content": "\ud83d\udc7eCVE SERVICE \ud83c\udff7#CVE\nMumber: CVE-2022-0543\nGithub: https://github.com/JacobEbben/CVE-2022-0543\nDescribe: \nIt was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.", "creation_timestamp": "2026-07-30T00:01:41.340814Z"}, {"uuid": "e760f23c-b120-4c4b-8611-82c7dd517623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/reverseame/2374", "content": "CVE-2022-0543 Technical Analysis https://attackerkb.com/topics/wyA1c1HIC8/cve-2022-0543/rapid7-analysis", "creation_timestamp": "2026-07-30T00:02:36.462323Z"}, {"uuid": "16b65fc1-7e4f-48e2-aeff-cc7613facc3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5801", "content": "Prove exploitation risk for these 5 widespread CVEs with Sniper\nBesides the high-risk\n 1 the critical RCE vulnerability that impacts various Redis versions - CVE-2022-0543 (CVSSv3. 10)\n 2 another high-risk RCE vulnerability affecting VMware Workspace ONE Access and Identity Manager - CVE-2022-22954 (CVSSv3 9.8)\n 3 the critical RCE vulnerability found in specific Apache Struts 2 versions - CVE-2021-31805 (CVSSv3 9.8)\n 4 the severe RCE vulnerability discovered in different Drupal versions - CVE-2018-7600 (CVSSv3 9.8)\n 5 the unrestricted file upload vulnerability found in Adobe ColdFusion versions - CVE-2018-15961 (CVSSv3 9.8", "creation_timestamp": "2026-09-01T17:00:29.709841Z"}, {"uuid": "7195c59c-4b21-4acf-bba3-9c27216cb508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5669", "content": "Muhstik botnet is targeting Redis servers using a recently disclosed highly critical vulnerability (CVE-2022-0543 / CVSS 10.0) in the database system.\n\nRead details: https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html", "creation_timestamp": "2026-09-01T17:00:30.874365Z"}, {"uuid": "4dfe9d0b-e32d-43ab-a356-2474df1e680b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/112353", "content": "Black Hat Ethical Hacking\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer Network\n\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA sophisticated and rapidly spreading malware, known as P2PInfect, is currently on the prowl, targeting vulnerable instances of SSH and Redis open-source data store. This malicious worm, developed in Rust, has versions compatible with both Windows and Linux, making it a cross-platform menace. P2PInfect methods of gaining footholdP2PInfect leverages two main methods to gain a foothold on its targets. Firstly, it exploits a critical vulnerability, CVE-2022-0543, which was disclosed and patched last year. This vulnerability is specific to Debian and allows remote code execution with a severity score of 10 out of 10. Secondly, the malware capitalizes on Redis\u2019 replication feature, which enables the creation of exact replicas of the main database for high availability and failover scenarios.\n\nSecurity researchers from Palo Alto Networks\u2019 Unit 42 initially documented P2PInfect and found it exploiting the CVE-2022-0543 vulnerability. Once a vulnerable Redis instance is compromised, P2PInfect downloads OS-specific scripts and malicious binaries, incorporating the server into its list of infected systems. The malware then establishes a peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nA sample of P2PInfect analyzed by Cado Security also revealed its compatibility with both Windows (PE binaries) and Linux (ELF binaries). The malware demonstrates a level of sophistication that poses a serious challenge for security experts.\n\nhttps://www.bleepstatic.com/images/news/u/1100723/P2PInfect_Redis_replica.jpg P2PInfect taking control via Redis replication feature\nsource: Cado Security\n\nAfter execution, P2PInfect\u2019s primary payload, an ELF binary written in a combination of C and Rust, updates the SSH configuration on the host, allowing the attacker to connect via SSH and enable password authentication. The malware further takes steps to hinder incident responders and evade detection by renaming critical binaries like wget and curl. Additionally, it installs necessary utilities, such as iptables and awk, to execute its actions.\n\nCado Security researchers discovered that P2PInfect treats each compromised Redis server as a node, effectively transforming the network into a decentralized, peer-to-peer botnet. This approach eliminates the need for a centralized command and control (C2) server, making it more resilient and difficult to track.\n\nCommunication between the peer-to-peer network occurs through a simple HTTP server over random ports, while botnet coordination is conducted over HTTPS using a hardcoded certificate. The campaign appears to have started on or after June 29th, as indicated by the certificate.\nTrending: The Difference between Internal and External Pentesting Trending: Offensive Security Tool: Nucleimonst3r P2PInfect\u2019s method of finding vulnerable servers involves scanning for exposed SSH and Redis instances, using a list of passwords for brute-force attempts on weakly protected hosts. Researchers estimate that there are over 307,000 Redis instances reachable over the public internet, making it a massive pool of potential targets.\n\nAs of now, the purpose of P2PInfect remains unclear. The presence of a binary called \u201cminer\u201d initially raised suspicions of cryptocurrency mining [...]", "creation_timestamp": "2026-09-01T20:00:53.334733Z"}, {"uuid": "f239e967-90e2-4ae0-b6bd-24b02a840284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/110998", "content": "Black Hat Ethical Hacking\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed Systems\n\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed SystemsPost Views: 27 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent breakthrough, security researchers from Unit 42 have unearthed a new peer-to-peer (P2P) malware with a unique self-spreading capability. This sophisticated worm, named P2PInfect, strategically targets Redis instances running on Internet-exposed Windows and Linux systems. The discovery also revealed that the malware capitalizes on the maximum severity CVE-2022-0543 Lua sandbox escape vulnerability to hack into vulnerable Redis servers.\n\nDuring their investigation, the researchers came across more than 307,000 Redis servers exposed on the Internet in the past two weeks. Among them, 934 instances were identified as potentially susceptible to P2PInfect attacks. However, the worm doesn\u2019t discriminate and attempts to compromise any target, even if not all are vulnerable.\n\n\u201cWe have caught several samples within our HoneyCloud platform, across multiple geographic regions, and we strongly believe the number of P2P nodes is growing,\u201d shared the researchers. They pointed out the vast pool of potential targets and the spread of the worm across diverse regions. Nevertheless, an exact estimate of the existing nodes or the speed of growth of the malicious network linked to P2PInfect remains unknown.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Gaining Control through CVE-2022-0543 VulnerabilityOnce P2PInfect successfully exploits the CVE-2022-0543 flaw, it gains remote code execution capabilities on the compromised devices. Following deployment, the malware sets up a peer-to-peer (P2P) communication channel, establishing a broader interconnected system. It then joins a P2P network with other infected devices, enabling automatic propagation, and proceeds to download additional malicious binaries, including scanning tools to locate other exposed Redis servers.\n\nExperts assert that P2PInfect\u2019s exploitation of the CVE-2022-0543 vulnerability grants it enhanced operation and propagation abilities, particularly in cloud container environments. The researchers believe that this campaign marks only the initial stage of a potentially more formidable attack, leveraging the robust P2P command and control (C2) network.\n\nRedis servers have long been a target for various threat actors, often ending up in DDoS and cryptojacking botnets. In the past, CVE-2022-0543 has been exploited by botnets like Muhstik and Redigo for DDoS attacks and brute-forcing attempts.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Offensive Security Tool: Nucleimonst3r\nThe large number of exposed Redis instances online poses a concerning security concern, as many server admins may be unaware that Redis does not have a secure-by-default configuration. The official Redis documentation indicates that the servers are designed for closed IT networks and lack an enabled access control mechanism by default. Redis statementIn response to the discovery, Redis issued a statement emphasizing that Redis Enterprise software is not vulnerable to CVE-2022-0543, as it uses a hardened version of the Lua module. Therefore, customers running Redis Enterprise licensed software are not at risk from P2PInfect. Open-source Redis users are urged to use official distributions available directly from redis.io [...]", "creation_timestamp": "2026-09-01T20:00:53.922815Z"}, {"uuid": "17d8111b-b4c0-4da9-a536-7ac8865e5be9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "creation_timestamp": "2026-09-01T20:01:15.101397Z"}, {"uuid": "05eba032-b652-4da4-9ddb-5395688652ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/112353", "content": "Black Hat Ethical Hacking\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer Network\n\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA sophisticated and rapidly spreading malware, known as P2PInfect, is currently on the prowl, targeting vulnerable instances of SSH and Redis open-source data store. This malicious worm, developed in Rust, has versions compatible with both Windows and Linux, making it a cross-platform menace. P2PInfect methods of gaining footholdP2PInfect leverages two main methods to gain a foothold on its targets. Firstly, it exploits a critical vulnerability, CVE-2022-0543, which was disclosed and patched last year. This vulnerability is specific to Debian and allows remote code execution with a severity score of 10 out of 10. Secondly, the malware capitalizes on Redis\u2019 replication feature, which enables the creation of exact replicas of the main database for high availability and failover scenarios.\n\nSecurity researchers from Palo Alto Networks\u2019 Unit 42 initially documented P2PInfect and found it exploiting the CVE-2022-0543 vulnerability. Once a vulnerable Redis instance is compromised, P2PInfect downloads OS-specific scripts and malicious binaries, incorporating the server into its list of infected systems. The malware then establishes a peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nA sample of P2PInfect analyzed by Cado Security also revealed its compatibility with both Windows (PE binaries) and Linux (ELF binaries). The malware demonstrates a level of sophistication that poses a serious challenge for security experts.\n\nhttps://www.bleepstatic.com/images/news/u/1100723/P2PInfect_Redis_replica.jpg P2PInfect taking control via Redis replication feature\nsource: Cado Security\n\nAfter execution, P2PInfect\u2019s primary payload, an ELF binary written in a combination of C and Rust, updates the SSH configuration on the host, allowing the attacker to connect via SSH and enable password authentication. The malware further takes steps to hinder incident responders and evade detection by renaming critical binaries like wget and curl. Additionally, it installs necessary utilities, such as iptables and awk, to execute its actions.\n\nCado Security researchers discovered that P2PInfect treats each compromised Redis server as a node, effectively transforming the network into a decentralized, peer-to-peer botnet. This approach eliminates the need for a centralized command and control (C2) server, making it more resilient and difficult to track.\n\nCommunication between the peer-to-peer network occurs through a simple HTTP server over random ports, while botnet coordination is conducted over HTTPS using a hardcoded certificate. The campaign appears to have started on or after June 29th, as indicated by the certificate.\nTrending: The Difference between Internal and External Pentesting Trending: Offensive Security Tool: Nucleimonst3r P2PInfect\u2019s method of finding vulnerable servers involves scanning for exposed SSH and Redis instances, using a list of passwords for brute-force attempts on weakly protected hosts. Researchers estimate that there are over 307,000 Redis instances reachable over the public internet, making it a massive pool of potential targets.\n\nAs of now, the purpose of P2PInfect remains unclear. The presence of a binary called \u201cminer\u201d initially raised suspicions of cryptocurrency mining [...]", "creation_timestamp": "2026-09-02T01:01:13.118934Z"}, {"uuid": "e5fb8b97-5320-4e52-ad83-e66001eba991", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/110998", "content": "Black Hat Ethical Hacking\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed Systems\n\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed SystemsPost Views: 27 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent breakthrough, security researchers from Unit 42 have unearthed a new peer-to-peer (P2P) malware with a unique self-spreading capability. This sophisticated worm, named P2PInfect, strategically targets Redis instances running on Internet-exposed Windows and Linux systems. The discovery also revealed that the malware capitalizes on the maximum severity CVE-2022-0543 Lua sandbox escape vulnerability to hack into vulnerable Redis servers.\n\nDuring their investigation, the researchers came across more than 307,000 Redis servers exposed on the Internet in the past two weeks. Among them, 934 instances were identified as potentially susceptible to P2PInfect attacks. However, the worm doesn\u2019t discriminate and attempts to compromise any target, even if not all are vulnerable.\n\n\u201cWe have caught several samples within our HoneyCloud platform, across multiple geographic regions, and we strongly believe the number of P2P nodes is growing,\u201d shared the researchers. They pointed out the vast pool of potential targets and the spread of the worm across diverse regions. Nevertheless, an exact estimate of the existing nodes or the speed of growth of the malicious network linked to P2PInfect remains unknown.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Gaining Control through CVE-2022-0543 VulnerabilityOnce P2PInfect successfully exploits the CVE-2022-0543 flaw, it gains remote code execution capabilities on the compromised devices. Following deployment, the malware sets up a peer-to-peer (P2P) communication channel, establishing a broader interconnected system. It then joins a P2P network with other infected devices, enabling automatic propagation, and proceeds to download additional malicious binaries, including scanning tools to locate other exposed Redis servers.\n\nExperts assert that P2PInfect\u2019s exploitation of the CVE-2022-0543 vulnerability grants it enhanced operation and propagation abilities, particularly in cloud container environments. The researchers believe that this campaign marks only the initial stage of a potentially more formidable attack, leveraging the robust P2P command and control (C2) network.\n\nRedis servers have long been a target for various threat actors, often ending up in DDoS and cryptojacking botnets. In the past, CVE-2022-0543 has been exploited by botnets like Muhstik and Redigo for DDoS attacks and brute-forcing attempts.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Offensive Security Tool: Nucleimonst3r\nThe large number of exposed Redis instances online poses a concerning security concern, as many server admins may be unaware that Redis does not have a secure-by-default configuration. The official Redis documentation indicates that the servers are designed for closed IT networks and lack an enabled access control mechanism by default. Redis statementIn response to the discovery, Redis issued a statement emphasizing that Redis Enterprise software is not vulnerable to CVE-2022-0543, as it uses a hardened version of the Lua module. Therefore, customers running Redis Enterprise licensed software are not at risk from P2PInfect. Open-source Redis users are urged to use official distributions available directly from redis.io [...]", "creation_timestamp": "2026-09-02T01:01:14.345902Z"}, {"uuid": "1169d6ac-e50a-4e13-a14c-41e1db6a4a91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "creation_timestamp": "2026-09-02T01:01:32.469405Z"}, {"uuid": "487a635d-9505-4334-b012-a1399d71b6e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5669", "content": "Muhstik botnet is targeting Redis servers using a recently disclosed highly critical vulnerability (CVE-2022-0543 / CVSS 10.0) in the database system.\n\nRead details: https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html", "creation_timestamp": "2026-09-02T01:04:13.953646Z"}, {"uuid": "0eb7c3b8-5462-4ae7-a5e6-9d975bbc0e26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5801", "content": "Prove exploitation risk for these 5 widespread CVEs with Sniper\nBesides the high-risk\n 1 the critical RCE vulnerability that impacts various Redis versions - CVE-2022-0543 (CVSSv3. 10)\n 2 another high-risk RCE vulnerability affecting VMware Workspace ONE Access and Identity Manager - CVE-2022-22954 (CVSSv3 9.8)\n 3 the critical RCE vulnerability found in specific Apache Struts 2 versions - CVE-2021-31805 (CVSSv3 9.8)\n 4 the severe RCE vulnerability discovered in different Drupal versions - CVE-2018-7600 (CVSSv3 9.8)\n 5 the unrestricted file upload vulnerability found in Adobe ColdFusion versions - CVE-2018-15961 (CVSSv3 9.8", "creation_timestamp": "2026-09-02T01:04:12.699664Z"}, {"uuid": "2ef37187-d3e0-4b65-8990-37bb8305120c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/112353", "content": "Black Hat Ethical Hacking\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer Network\n\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA sophisticated and rapidly spreading malware, known as P2PInfect, is currently on the prowl, targeting vulnerable instances of SSH and Redis open-source data store. This malicious worm, developed in Rust, has versions compatible with both Windows and Linux, making it a cross-platform menace. P2PInfect methods of gaining footholdP2PInfect leverages two main methods to gain a foothold on its targets. Firstly, it exploits a critical vulnerability, CVE-2022-0543, which was disclosed and patched last year. This vulnerability is specific to Debian and allows remote code execution with a severity score of 10 out of 10. Secondly, the malware capitalizes on Redis\u2019 replication feature, which enables the creation of exact replicas of the main database for high availability and failover scenarios.\n\nSecurity researchers from Palo Alto Networks\u2019 Unit 42 initially documented P2PInfect and found it exploiting the CVE-2022-0543 vulnerability. Once a vulnerable Redis instance is compromised, P2PInfect downloads OS-specific scripts and malicious binaries, incorporating the server into its list of infected systems. The malware then establishes a peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nA sample of P2PInfect analyzed by Cado Security also revealed its compatibility with both Windows (PE binaries) and Linux (ELF binaries). The malware demonstrates a level of sophistication that poses a serious challenge for security experts.\n\nhttps://www.bleepstatic.com/images/news/u/1100723/P2PInfect_Redis_replica.jpg P2PInfect taking control via Redis replication feature\nsource: Cado Security\n\nAfter execution, P2PInfect\u2019s primary payload, an ELF binary written in a combination of C and Rust, updates the SSH configuration on the host, allowing the attacker to connect via SSH and enable password authentication. The malware further takes steps to hinder incident responders and evade detection by renaming critical binaries like wget and curl. Additionally, it installs necessary utilities, such as iptables and awk, to execute its actions.\n\nCado Security researchers discovered that P2PInfect treats each compromised Redis server as a node, effectively transforming the network into a decentralized, peer-to-peer botnet. This approach eliminates the need for a centralized command and control (C2) server, making it more resilient and difficult to track.\n\nCommunication between the peer-to-peer network occurs through a simple HTTP server over random ports, while botnet coordination is conducted over HTTPS using a hardcoded certificate. The campaign appears to have started on or after June 29th, as indicated by the certificate.\nTrending: The Difference between Internal and External Pentesting Trending: Offensive Security Tool: Nucleimonst3r P2PInfect\u2019s method of finding vulnerable servers involves scanning for exposed SSH and Redis instances, using a list of passwords for brute-force attempts on weakly protected hosts. Researchers estimate that there are over 307,000 Redis instances reachable over the public internet, making it a massive pool of potential targets.\n\nAs of now, the purpose of P2PInfect remains unclear. The presence of a binary called \u201cminer\u201d initially raised suspicions of cryptocurrency mining [...]", "creation_timestamp": "2026-09-04T10:00:05.194622Z"}, {"uuid": "2b937d29-1162-41dd-b92a-a7ff0516e5cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/110998", "content": "Black Hat Ethical Hacking\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed Systems\n\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed SystemsPost Views: 27 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent breakthrough, security researchers from Unit 42 have unearthed a new peer-to-peer (P2P) malware with a unique self-spreading capability. This sophisticated worm, named P2PInfect, strategically targets Redis instances running on Internet-exposed Windows and Linux systems. The discovery also revealed that the malware capitalizes on the maximum severity CVE-2022-0543 Lua sandbox escape vulnerability to hack into vulnerable Redis servers.\n\nDuring their investigation, the researchers came across more than 307,000 Redis servers exposed on the Internet in the past two weeks. Among them, 934 instances were identified as potentially susceptible to P2PInfect attacks. However, the worm doesn\u2019t discriminate and attempts to compromise any target, even if not all are vulnerable.\n\n\u201cWe have caught several samples within our HoneyCloud platform, across multiple geographic regions, and we strongly believe the number of P2P nodes is growing,\u201d shared the researchers. They pointed out the vast pool of potential targets and the spread of the worm across diverse regions. Nevertheless, an exact estimate of the existing nodes or the speed of growth of the malicious network linked to P2PInfect remains unknown.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Gaining Control through CVE-2022-0543 VulnerabilityOnce P2PInfect successfully exploits the CVE-2022-0543 flaw, it gains remote code execution capabilities on the compromised devices. Following deployment, the malware sets up a peer-to-peer (P2P) communication channel, establishing a broader interconnected system. It then joins a P2P network with other infected devices, enabling automatic propagation, and proceeds to download additional malicious binaries, including scanning tools to locate other exposed Redis servers.\n\nExperts assert that P2PInfect\u2019s exploitation of the CVE-2022-0543 vulnerability grants it enhanced operation and propagation abilities, particularly in cloud container environments. The researchers believe that this campaign marks only the initial stage of a potentially more formidable attack, leveraging the robust P2P command and control (C2) network.\n\nRedis servers have long been a target for various threat actors, often ending up in DDoS and cryptojacking botnets. In the past, CVE-2022-0543 has been exploited by botnets like Muhstik and Redigo for DDoS attacks and brute-forcing attempts.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Offensive Security Tool: Nucleimonst3r\nThe large number of exposed Redis instances online poses a concerning security concern, as many server admins may be unaware that Redis does not have a secure-by-default configuration. The official Redis documentation indicates that the servers are designed for closed IT networks and lack an enabled access control mechanism by default. Redis statementIn response to the discovery, Redis issued a statement emphasizing that Redis Enterprise software is not vulnerable to CVE-2022-0543, as it uses a hardened version of the Lua module. Therefore, customers running Redis Enterprise licensed software are not at risk from P2PInfect. Open-source Redis users are urged to use official distributions available directly from redis.io [...]", "creation_timestamp": "2026-09-04T11:00:05.135028Z"}, {"uuid": "1b37f8e3-c561-4754-9ead-24a3b8573bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/112353", "content": "Black Hat Ethical Hacking\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer Network\n\nP2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkPost Views: 3 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nA sophisticated and rapidly spreading malware, known as P2PInfect, is currently on the prowl, targeting vulnerable instances of SSH and Redis open-source data store. This malicious worm, developed in Rust, has versions compatible with both Windows and Linux, making it a cross-platform menace. P2PInfect methods of gaining footholdP2PInfect leverages two main methods to gain a foothold on its targets. Firstly, it exploits a critical vulnerability, CVE-2022-0543, which was disclosed and patched last year. This vulnerability is specific to Debian and allows remote code execution with a severity score of 10 out of 10. Secondly, the malware capitalizes on Redis\u2019 replication feature, which enables the creation of exact replicas of the main database for high availability and failover scenarios.\n\nSecurity researchers from Palo Alto Networks\u2019 Unit 42 initially documented P2PInfect and found it exploiting the CVE-2022-0543 vulnerability. Once a vulnerable Redis instance is compromised, P2PInfect downloads OS-specific scripts and malicious binaries, incorporating the server into its list of infected systems. The malware then establishes a peer-to-peer network, allowing future compromised Redis servers to access the bundle of malicious payloads.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nA sample of P2PInfect analyzed by Cado Security also revealed its compatibility with both Windows (PE binaries) and Linux (ELF binaries). The malware demonstrates a level of sophistication that poses a serious challenge for security experts.\n\nhttps://www.bleepstatic.com/images/news/u/1100723/P2PInfect_Redis_replica.jpg P2PInfect taking control via Redis replication feature\nsource: Cado Security\n\nAfter execution, P2PInfect\u2019s primary payload, an ELF binary written in a combination of C and Rust, updates the SSH configuration on the host, allowing the attacker to connect via SSH and enable password authentication. The malware further takes steps to hinder incident responders and evade detection by renaming critical binaries like wget and curl. Additionally, it installs necessary utilities, such as iptables and awk, to execute its actions.\n\nCado Security researchers discovered that P2PInfect treats each compromised Redis server as a node, effectively transforming the network into a decentralized, peer-to-peer botnet. This approach eliminates the need for a centralized command and control (C2) server, making it more resilient and difficult to track.\n\nCommunication between the peer-to-peer network occurs through a simple HTTP server over random ports, while botnet coordination is conducted over HTTPS using a hardcoded certificate. The campaign appears to have started on or after June 29th, as indicated by the certificate.\nTrending: The Difference between Internal and External Pentesting Trending: Offensive Security Tool: Nucleimonst3r P2PInfect\u2019s method of finding vulnerable servers involves scanning for exposed SSH and Redis instances, using a list of passwords for brute-force attempts on weakly protected hosts. Researchers estimate that there are over 307,000 Redis instances reachable over the public internet, making it a massive pool of potential targets.\n\nAs of now, the purpose of P2PInfect remains unclear. The presence of a binary called \u201cminer\u201d initially raised suspicions of cryptocurrency mining [...]", "creation_timestamp": "2026-09-05T01:00:32.610878Z"}, {"uuid": "a8d0b6ea-6cd4-42be-8a95-13fa312276b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/110998", "content": "Black Hat Ethical Hacking\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed Systems\n\nNew P2PInfect Malware, Self-Spreading Worm Targets Redis Instances on Internet-Exposed SystemsPost Views: 27 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn a recent breakthrough, security researchers from Unit 42 have unearthed a new peer-to-peer (P2P) malware with a unique self-spreading capability. This sophisticated worm, named P2PInfect, strategically targets Redis instances running on Internet-exposed Windows and Linux systems. The discovery also revealed that the malware capitalizes on the maximum severity CVE-2022-0543 Lua sandbox escape vulnerability to hack into vulnerable Redis servers.\n\nDuring their investigation, the researchers came across more than 307,000 Redis servers exposed on the Internet in the past two weeks. Among them, 934 instances were identified as potentially susceptible to P2PInfect attacks. However, the worm doesn\u2019t discriminate and attempts to compromise any target, even if not all are vulnerable.\n\n\u201cWe have caught several samples within our HoneyCloud platform, across multiple geographic regions, and we strongly believe the number of P2P nodes is growing,\u201d shared the researchers. They pointed out the vast pool of potential targets and the spread of the worm across diverse regions. Nevertheless, an exact estimate of the existing nodes or the speed of growth of the malicious network linked to P2PInfect remains unknown.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses Gaining Control through CVE-2022-0543 VulnerabilityOnce P2PInfect successfully exploits the CVE-2022-0543 flaw, it gains remote code execution capabilities on the compromised devices. Following deployment, the malware sets up a peer-to-peer (P2P) communication channel, establishing a broader interconnected system. It then joins a P2P network with other infected devices, enabling automatic propagation, and proceeds to download additional malicious binaries, including scanning tools to locate other exposed Redis servers.\n\nExperts assert that P2PInfect\u2019s exploitation of the CVE-2022-0543 vulnerability grants it enhanced operation and propagation abilities, particularly in cloud container environments. The researchers believe that this campaign marks only the initial stage of a potentially more formidable attack, leveraging the robust P2P command and control (C2) network.\n\nRedis servers have long been a target for various threat actors, often ending up in DDoS and cryptojacking botnets. In the past, CVE-2022-0543 has been exploited by botnets like Muhstik and Redigo for DDoS attacks and brute-forcing attempts.\nTrending: Post-Exploitation Techniques: Maintaining Access, Escalating Privileges, Gathering Credentials, Covering Tracks Trending: Offensive Security Tool: Nucleimonst3r\nThe large number of exposed Redis instances online poses a concerning security concern, as many server admins may be unaware that Redis does not have a secure-by-default configuration. The official Redis documentation indicates that the servers are designed for closed IT networks and lack an enabled access control mechanism by default. Redis statementIn response to the discovery, Redis issued a statement emphasizing that Redis Enterprise software is not vulnerable to CVE-2022-0543, as it uses a hardened version of the Lua module. Therefore, customers running Redis Enterprise licensed software are not at risk from P2PInfect. Open-source Redis users are urged to use official distributions available directly from redis.io [...]", "creation_timestamp": "2026-09-05T01:00:31.985602Z"}, {"uuid": "9b0844fb-c258-4eeb-a90c-ef2cc0e36cab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "creation_timestamp": "2026-09-05T04:00:04.650919Z"}, {"uuid": "cae38167-efbc-4cff-b7b5-7f2d71a2ec15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/hacking_Attack/78645", "content": "Black Hat Ethical Hacking\nNew Redigo malware drops stealthy backdoor on Redis servers\n\nNew Redigo malware drops stealthy backdoor on Redis serversPost Views: 68 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Go-based malware RedigoA new Go-based malware threat that researchers call Redigo\u00a0has been targeting Redis\u00a0servers vulnerable to CVE-2022-0543 to plant a stealthy backdoor and allow\u00a0command execution.\n\nCVE-2022-0543 is a critical vulnerability in Redis (Remote Dictionary Server) software with a maximum severity rating. It was\u00a0discovered and fixed in February 2022.\n\nAttackers continued to leverage it on unpatched machines several months\u00a0after the fix came out, as proof-of-concept exploit code\u00a0became publicly available.\n\nThe name of the malware, Redigo, was coined from the machine it targets and the programming language for building it.\n\nToday, AquaSec reports\u00a0that its Redis honeypots vulnerable to CVE-2022-0543 caught a new piece of malware that is not detected as a threat by antivirus engines on Virus Total.\nhttps://www.bleepstatic.com/images/news/u/1220909/Website%20snaps/vt.png \n<figcaptionRedigo\u00a0payload coming out clean on Virus Total scan (AquaSec) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Redigo attacksAquaSec says that Redigo attacks start with scans on port 6379 to locate Redis servers exposed on the open web.\u00a0After locating a target endpoint, the atacker connect and run the following commands:\n\n* INFO\u00a0\u2013 Check the Redis version to determine if the server is vulnerable to CVE-2022-0543.\n* SLAVEOF\u00a0\u2013 Create a copy of the attacking server.\n* REPLCONF\u00a0\u2013 Configure the connection from the attacking server to the newly created replica.\n* PSYNC\u00a0\u2013 Initiate the replication stream and download the shared library \u2018exp_lin.so\u2019 on the server\u2019s disk.\n* MODULE LOAD\u00a0\u2013 Load module from the downloaded dynamic library, which is capable of executing arbitrary commands and exploiting CVE-2022-0543.\n* SLAVEOF NO ONE\u00a0\u2013 Covert the vulnerable Redis server into master.\n* \n\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/commands-redigo.png \n<figcaptionCommands observed in the Redis honeypot (AquaSec) \nUsing the command execution abilities of the implanted backdoor, the attackers collect hardware info about the host and then download Redigo (redis-1.2-SNAPSHOT). The malware is executed after escalating privileges.\n\nThe attackers simulate normal Redis communication over port 6379 to evade detection by network analysis tools while attempting to hide traffing from Redigo\u2019s command and control server.\n\nDue to attack duration limitations in AquaSec\u2019s honeypots, its analysts couldn\u2019t determine exactly what Redigo does after establishing its foothold in the environment.\nhttps://www.bleepstatic.com/images/news/u/1220909/Code%20and%20Details/redigo-functions.png \n<figcaptionRedigo malware functions (AquaSec) \nTrending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo Trending: Offensive Security Tool: linWinPwn Mitigation\u200bAquaSec says it\u2019s likely that the ultimate goal of Redigo is to add the vulnerable server as a bot in a network for distributed denial-of-service (DDoS) attacks or to run cryptocurrency miners on the compromised systems.\n\nAlso, since Redis is a database, accessing the data to steal it would also be a plausible scenario in\u00a0Redigo attacks.\n\nFor more information on mitigating the Redis flaw, check out the Debian security advisory\u00a0or Ubuntu\u2019s security bulletin\u00a0on CVE-2022-0543.\nTrending: AXLocker \u2013 a new ransomware that encrypts yours files, and then steals your Discord a[...]", "creation_timestamp": "2026-09-06T00:00:59.376369Z"}, {"uuid": "c2b87fc0-6e2f-4dff-b370-a4686ac3e8e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Reginaldo Silva\", \"jbaines-r7\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits CVE-2022-0543, a Lua-based Redis sandbox escape. The\\n          vulnerability was introduced by Debian and Ubuntu Redis packages that\\n          insufficiently sanitized the Lua environment. The maintainers failed to\\n          disable the package interface, allowing attackers to load arbitrary libraries.\\n\\n          On a typical `redis` deployment (not docker), this module achieves execution\\n          as the `redis` user. Debian/Ubuntu packages run Redis using systemd with the\\n          \\\"MemoryDenyWriteExecute\\\" permission, which limits some of what an attacker can\\n          do. For example, staged meterpreter will fail when attempting to use mprotect.\\n          As such, stageless meterpreter is the preferred payload.\\n\\n          Redis can be configured with authentication or not. This module will work with\\n          either configuration (provided you provide the correct authentication details).\\n          This vulnerability could theoretically be exploited across a few architectures:\\n          i386, arm, ppc, etc. However, the module only supports x86_64, which is likely\\n          to be the most popular version.\", \"disclosure_date\": \"2022-02-18\", \"fullname\": \"exploit/linux/redis/redis_debian_sandbox_escape\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Redis Lua Sandbox Escape\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/redis/redis_debian_sandbox_escape.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/redis/redis_debian_sandbox_escape\", \"references\": [\"CVE-2022-0543\", \"URL-https://www.lua.org/pil/8.2.html\", \"URL-https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce\", \"URL-https://www.debian.org/security/2022/dsa-5081\", \"URL-http://web.archive.org/web/20240910172732/https://ubuntu.com/security/CVE-2022-0543\"], \"rport\": 6379, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:21.483432Z"}, {"uuid": "4365f46d-242e-43b2-b46c-6bfe4d031f71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5801", "content": "Prove exploitation risk for these 5 widespread CVEs with Sniper\nBesides the high-risk\n 1 the critical RCE vulnerability that impacts various Redis versions - CVE-2022-0543 (CVSSv3. 10)\n 2 another high-risk RCE vulnerability affecting VMware Workspace ONE Access and Identity Manager - CVE-2022-22954 (CVSSv3 9.8)\n 3 the critical RCE vulnerability found in specific Apache Struts 2 versions - CVE-2021-31805 (CVSSv3 9.8)\n 4 the severe RCE vulnerability discovered in different Drupal versions - CVE-2018-7600 (CVSSv3 9.8)\n 5 the unrestricted file upload vulnerability found in Adobe ColdFusion versions - CVE-2018-15961 (CVSSv3 9.8", "creation_timestamp": "2026-09-10T09:00:06.971119Z"}, {"uuid": "4f4bddf6-7cb5-4d1b-a06b-e56a8d7bd2a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/cissp/5669", "content": "Muhstik botnet is targeting Redis servers using a recently disclosed highly critical vulnerability (CVE-2022-0543 / CVSS 10.0) in the database system.\n\nRead details: https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html", "creation_timestamp": "2026-09-10T11:00:04.696008Z"}, {"uuid": "1ad38aeb-9214-4447-b031-322348e256ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "exploited", "source": "https://t.me/cissp/5669", "content": "Muhstik botnet is targeting Redis servers using a recently disclosed highly critical vulnerability (CVE-2022-0543 / CVSS 10.0) in the database system.\n\nRead details: https://thehackernews.com/2022/03/muhstik-botnet-targeting-redis-servers.html", "creation_timestamp": "2026-09-11T00:00:42.744646Z"}, {"uuid": "c354a062-f6a0-41e9-a449-532422b73b5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-0543", "type": "seen", "source": "https://t.me/cissp/5801", "content": "Prove exploitation risk for these 5 widespread CVEs with Sniper\nBesides the high-risk\n 1 the critical RCE vulnerability that impacts various Redis versions - CVE-2022-0543 (CVSSv3. 10)\n 2 another high-risk RCE vulnerability affecting VMware Workspace ONE Access and Identity Manager - CVE-2022-22954 (CVSSv3 9.8)\n 3 the critical RCE vulnerability found in specific Apache Struts 2 versions - CVE-2021-31805 (CVSSv3 9.8)\n 4 the severe RCE vulnerability discovered in different Drupal versions - CVE-2018-7600 (CVSSv3 9.8)\n 5 the unrestricted file upload vulnerability found in Adobe ColdFusion versions - CVE-2018-15961 (CVSSv3 9.8", "creation_timestamp": "2026-09-11T00:00:45.601423Z"}]}