Boston and Tel-Aviv, Israel – September 14, 2020 – Aqua Security, the pure-play cloud native security leader, today released a new threat report by Team Nautilus, Aqua’s cybersecurity research team, that reveals a growing, organized and increasingly sophisticated pattern of attacks on cloud native infrastructure. While most attacks were aimed at abusing public cloud compute resources for cryptocurrency mining, the methods used open the door for higher-value targets that leverage security gaps in container software supply chains and runtime environments.
The full 70-page report provides a detailed account of attacks observed in the wild during a full year of detailed observation and tracing. This is the first such report to outline the precise, systematic methods used to attack container infrastructure, and to highlight supply chain attacks as an emerging threat.
The report provides trends and observed categories of attacks, but also explains in great detail the specific progression of several attack vectors, from the originating malicious images to the specific evasion techniques, malicious payloads, and propagation attempts. The detailed analysis of the attacks was made possible using Aqua’s Dynamic Threat Analysis (DTA) tool, which was announced by Aqua earlier this year. Aqua DTA runs suspicious images as sandboxed containers to safely observe and trace their behavior, and is integrated into Aqua’s full-lifecycle solution to prevent such images from ever making it into production environments.
Highlights of the observed attacks include:
- Container images in public registries being poisoned with Potentially Unwanted Applications (PUAs) that cannot be detected using static scanning. They spring into action only when the container is running.
- Sophisticated evasion techniques are being used to hide attacks and make them more persistent. This includes the use of “vanilla” images that seem innocuous, disabling other malware, delaying before downloading payloads into the running container, using 64-bit encoding to obfuscate malware, and more.
- Since the beginning of 2020, the volume of attacks has dramatically increased, suggesting that there is organized infrastructure and systematic targeting behind these attacks. More than 16,000 individual attacks were tracked back to multiple locations across the globe.
- The main motivation of the malicious actors has been to hijack cloud compute resources to mine for cryptocurrency, but Team Nautilus has seen evidence that other objectives, such as establishing DDoS infrastructure, were also attempted.
“The attacks we observed are a significant step up in attacks targeting cloud native infrastructure. We expect a further increase in sophistication, the use of evasion techniques and diversity of the attack vectors and objectives, since the widespread the use of cloud native technologies makes them a more lucrative target for bad actors,” notes Idan Revivo, Head of Team Nautilus at Aqua. “Security teams are advised to take the appropriate measures both in their pipelines as well as runtime environments, to detect and intercept such attempts.”
In addition to the full report, a concise CISO executive brief document is available that provides an overview of the attacks and methods used, as well as actionable advice to security executives on how to protect against this new and growing breed of attacks.
To get the full report and CISO brief:
- CISO Executive Brief: Sophisticated Supply Chain Attacks on Container Infrastructure
- Threat Report: Evolution of Attacks in the Wild on Container Infrastructure
About Team Nautilus
Aqua’s Team Nautilus is a team of experienced cybersecurity researchers and analysts who focus on emerging threats to the cloud native stack. Its mission is to uncover new vulnerabilities, threats and attacks that target containers, Kubernetes, serverless, and public cloud infrastructure — enabling new methods and tools to address them. It is the world’s only research team purely dedicated to cloud native cybersecurity. For more information and to subscribe to threat alerts and updates, go to: aquasec.com/research
About Aqua Security
Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed. Aqua customers are among the world’s largest enterprises in financial services, software, media, manufacturing and retail, with implementations across a broad range of cloud providers and modern technology stacks spanning containers, serverless functions, and cloud VMs. For more information, visit www.aquasec.com or follow us on twitter.com/AquaSecTeam.
