Attacks Increasing on Cloud Native Infrastructure and Software Supply Chain
October 07, 2020

A new threat report by Team Nautilus, Aqua Security's cybersecurity research team, reveals a growing, organized and increasingly sophisticated pattern of attacks on cloud native infrastructure.

While most attacks were aimed at abusing public cloud compute resources for cryptocurrency mining, the methods used open the door for higher-value targets that leverage security gaps in container software supply chains and runtime environments.

Highlights of the observed attacks include:

■ 70.7% of the attacks were built to mislead and conceal their malicious nature.

■ Attacker IP addresses mainly originated from the US and China.

■ Container images in public registries being poisoned with Potentially Unwanted Applications (PUAs) that cannot be detected using static scanning. They spring into action only when the container is running.

■ Sophisticated evasion techniques are being used to hide attacks and make them more persistent. This includes the use of "vanilla" images that seem innocuous, disabling other malware, delaying before downloading payloads into the running container, using 64-bit encoding to obfuscate malware, and more.

■ Since the beginning of 2020, the volume of attacks has dramatically increased, suggesting that there is organized infrastructure and systematic targeting behind these attacks. More than 16,000 individual attacks were tracked back to multiple locations across the globe.

■ The main motivation of the malicious actors has been to hijack cloud compute resources to mine for cryptocurrency, but Team Nautilus has seen evidence that other objectives, such as establishing DDoS infrastructure, were also attempted.

"The attacks we observed are a significant step up in attacks targeting cloud native infrastructure. We expect a further increase in sophistication, the use of evasion techniques and diversity of the attack vectors and objectives, since the widespread the use of cloud native technologies makes them a more lucrative target for bad actors," notes Idan Revivo, Head of Team Nautilus at Aqua. "Security teams are advised to take the appropriate measures both in their pipelines as well as runtime environments, to detect and intercept such attempts."

The report recommends that security organizations address these three areas:

1. Protect the supply chain - shift-left security.

2. Control what you deploy.

3. Define a clear cloud native security strategy.

Share this

Industry News

January 27, 2021

Indigo.Design announced the public preview of Indigo.Design App Builder.

January 27, 2021

ARMO announced its launch out of stealth having secured $4.5 million in seed funding from Pitango First.

January 27, 2021

CloudSphere announced the appointment of Jane Gilson as the company’s CEO successor to Patrick McNally.

January 26, 2021

JFrog announced an agreement with Docker.

January 26, 2021

SUSE released Longhorn 1.1.

January 26, 2021

HAProxy released HAProxy Kubernetes Ingress Controller 1.5.

January 25, 2021

Progress announced the new release of Progress Kendo UI, a complete collection of JavaScript UI components.

January 25, 2021

CloudNatix announced the close of a $4.5M Seed round financing led by DNX Ventures, with the participation from a new investor Cota Capital and existing investors: Incubate Fund, Vela Partners and 468 Capital.

January 25, 2021

Quali announced $54 million in new funding, co-led by Greenfield Partners and JVP.

January 21, 2021

Platform9 released Platform9 Release 5.0, with a number of new features to provide operational efficiencies for its freedom, growth, and enterprise managed Kubernetes products.

January 21, 2021

Infragistics announced the release of Infragistics Ultimate 20.2, a complete UX and UI solution for  design and development teams  which is fully compatible with .NET 5, Microsoft’s latest  release of .NET development platform.

January 21, 2021

Couchbase Cloud is now available on Microsoft Azure.

January 20, 2021

Hitachi Vantara announced the availability of Hitachi Kubernetes Service, enabling customers to consistently and securely deploy, manage, monitor, and govern Kubernetes clusters across major cloud providers and on premises.

January 20, 2021

Internal announced the launch of an enterprise-ready app development platform for internal tools.

January 20, 2021

StackPulse announced a $20 million Series A led by GGV Capital.