[ad_1]
Attackers are discovering new methods to focus on cloud native environments, in keeping with Nautilus, the risk analysis staff of cloud native safety supplier, Aqua Safety.
The staff’s newest analysis reveals that adversaries are adopting extra refined strategies, leveraging a number of assault parts, and shifting consideration to Kubernetes and the software program provide chain. The “2022 Cloud Native Risk Report: Monitoring Software program Provide Chain and Kubernetes Assaults and Methods” supplies perception on tendencies and key takeaways for practitioners in regards to the cloud native risk panorama.
The examine revealed that adversaries are partaking with new techniques, strategies and procedures (TTPs) to particularly goal cloud native environments. Whereas cryptominers had been the most typical malware noticed, with rising frequency, Workforce Nautilus found an elevated utilization of backdoors, rootkits, and credential stealers — indicators that intruders have greater than cryptomining of their plans. Backdoors, which enable a risk actor to entry a system remotely and are used to ascertain persistence within the compromised atmosphere, had been encountered in 54% of assaults (up 9% in contrast with in 2020). Moreover, half of the malicious container photos (51%) analyzed by researchers contained worms, which permit attackers to extend the scope of their assault with minimal effort (up 10% in contrast with 2020).
Notably, risk actors additionally broadened their targets to incorporate CI/CD and Kubernetes environments. In 2021, 19% of the malicious container photos analyzed focused Kubernetes, together with kubelets and API servers, up 9% in contrast with the earlier yr.
Assaf Morag, Risk Intelligence and Knowledge Analyst Lead, Aqua’s Workforce Nautilus, mentioned: “These findings underscore the fact that cloud native environments now signify a goal for attackers, and that the strategies are at all times evolving.
“The broad assault floor of a Kubernetes cluster is enticing for risk actors, after which as soon as they’re in, they’re in search of low-hanging fruit.”
Different key findings:
The proportion and number of noticed assaults focusing on Kubernetes has elevated, and this features a wider adoption of the weaponization of Kubernetes UI instruments.
– Provide chain assaults signify 14.3% of the actual pattern of photos from public picture libraries, displaying that these assaults proceed to be an efficient methodology of attacking cloud native environments.
– The Log4j zero-day vulnerability was instantly exploited within the wild. Workforce Nautilus detected a number of malicious strategies, together with recognized malware, fileless execution, reverse shell executions, and recordsdata that had been downloaded and executed from reminiscence – all emphasizing the necessity for runtime safety
– Researchers noticed honeypot assaults by TeamTNT after the group introduced its retirement in December 2021. Nevertheless, no new techniques have been in use, so it’s unclear if the group continues to be in operation or if the continuing assaults originated from automated assault infrastructure. Regardless, enterprise groups ought to proceed preventative measures in opposition to these threats.
Aqua’s Workforce Nautilus made intensive use of honeypots to analyze assaults within the wild, and to analyze supply-chain assaults in opposition to cloud native purposes, the staff examined photos and packages from public registries and repositories, equivalent to DockerHub, NPM and Python Package deal Index. Workforce Nautilus utilised Aqua’s Dynamic Risk Evaluation (DTA) product to analyse every assault. Aqua DTA is the trade’s first container sandbox resolution that dynamically assesses container picture behaviours to find out whether or not they harbour hidden malware. This permits organizations to determine and mitigate assaults that static malware scanners can’t detect.
“The important thing takeaway from this report is that attackers are extremely lively — greater than ever earlier than — and extra often focusing on vulnerabilities in purposes, open supply and cloud know-how,” mentioned Morag. “Safety practitioners, builders and devops groups should search out safety options which might be purpose-built for cloud native. Implementing proactive and preventative safety measures will enable for stronger safety and finally defend environments.”
To make sure cloud environments are safe, Aqua’s Workforce Nautilus recommends implementing runtime safety measures, a layered strategy to Kubernetes safety, and scanning in improvement.
[ad_2]
