Microsoft has warned that Kubernetes clusters are being targeted in a cryptomining attack while Palo Alto Networks has identified the first malware that targets Windows Containers – in order to compromise the Kubernetes clusters that host them.

Cryptomining on Kubernetes

Kubeflow is a popular framework for deploying Machine Learning workloads in a Kubernetes environment.  Microsoft reports they have detected a spike in criminals injecting their own pods into Kubeflow environments that then mine cryptocurrency at the expense of the victim.  The criminals are using legitimate images from the official Docker Hub, but they are configured to run the criminal’s mining workloads.  Unless the system admins responsible for the Kubernetes environment are on the ball, a couple of extra pods running in the environment might not be noticed… until the hosting bill arrives at the end of the month.

As with many attacks on cloud-based resources, the root cause of this attack is insecurely configured administration portals.  In this case, the Kubeflow dashboard was exposed to the internet allowing the attackers to configure their own additional workloads at the customers’ expense.

In their blog post, Microsoft provide advice on how to list and spot unexpected containers that have been added to your environment and point out how Azure Defender could help detect exposed Kubeflow deployments.

Siloscape malware targets Windows Containers

Palo Alto Network’s Unit 42 has discovered what they think is the first malware that targets Windows Containers running under Kubernetes. The malware has been named Siloscape as it is designed to escape the Windows Container and then compromise the entire Kubernetes cluster in order to run their own malicious containers or steal data from the victim’s other containers in the cluster.

Microsoft has long maintained that Windows Containers, unlike virtual machines, are not considered security boundaries – each application running in a Windows Container should be treated as if it is executing on the host directly.  However, in the case of Siloscape, they are treating the ability to escape the container without administrator privilege as a vulnerability. (CVE-2021-24096)

Siloscape targets common cloud applications using known vulnerabilities and then escapes the Windows container in order to gain the ability to execute on the underlying node and so spread to the entire Kubernetes cluster.  Siloscape then phones homes to its command & control server and awaits further commands.

According to the researcher at Unit 42, the Siloscape powered campaign appears to have been active for over a year with more than 300 victims so far.

Unlike other malware targeting containers, which are mostly cryptojacking-focused, Siloscape doesn’t actually do anything that will harm the cluster on its own. Instead, it focuses on being undetected and untraceable and opens a backdoor to the cluster.
~ Daniel Prizmant, Unit 42

If Siloscape determines that the Kubernetes cluster has been securely configured preventing the creation of new deployments it will simply exit, thus underlining the importance of using trusted security baselines to ensure your cloud environments are deployed securely.