[ad_1]
Attackers are discovering new methods to focus on cloud native environments, in response to Nautilus, the menace analysis crew of cloud native safety supplier, Aqua Safety.
The crew’s newest analysis reveals that adversaries are adopting extra refined strategies, leveraging a number of assault elements, and shifting consideration to Kubernetes and the software program provide chain. The “2022 Cloud Native Menace Report: Monitoring Software program Provide Chain and Kubernetes Assaults and Methods” supplies perception on traits and key takeaways for practitioners concerning the cloud native menace panorama.
The examine revealed that adversaries are participating with new ways, strategies and procedures (TTPs) to particularly goal cloud native environments. Whereas cryptominers have been the most typical malware noticed, with growing frequency, Crew Nautilus found an elevated utilization of backdoors, rootkits, and credential stealers — indicators that intruders have greater than cryptomining of their plans. Backdoors, which enable a menace actor to entry a system remotely and are used to ascertain persistence within the compromised surroundings, have been encountered in 54% of assaults (up 9% in contrast with in 2020). Moreover, half of the malicious container photographs (51%) analyzed by researchers contained worms, which permit attackers to extend the scope of their assault with minimal effort (up 10% in contrast with 2020).
Notably, menace actors additionally broadened their targets to incorporate CI/CD and Kubernetes environments. In 2021, 19% of the malicious container photographs analyzed focused Kubernetes, together with kubelets and API servers, up 9% in contrast with the earlier yr.
Assaf Morag, Menace Intelligence and Information Analyst Lead, Aqua’s Crew Nautilus, stated: “These findings underscore the truth that cloud native environments now characterize a goal for attackers, and that the strategies are all the time evolving.
“The broad assault floor of a Kubernetes cluster is enticing for menace actors, after which as soon as they’re in, they’re searching for low-hanging fruit.”
Different key findings:
The proportion and number of noticed assaults concentrating on Kubernetes has elevated, and this features a wider adoption of the weaponization of Kubernetes UI instruments.
Provide chain assaults characterize 14.3% of the actual pattern of photographs from public picture libraries, displaying that these assaults proceed to be an efficient methodology of attacking cloud native environments.
The Log4j zero-day vulnerability was instantly exploited within the wild. Crew Nautilus detected a number of malicious strategies, together with recognized malware, fileless execution, reverse shell executions, and information that have been downloaded and executed from reminiscence – all emphasizing the necessity for runtime safety
Researchers noticed honeypot assaults by TeamTNT after the group introduced its retirement in December 2021. Nevertheless, no new ways have been in use, so it’s unclear if the group continues to be in operation or if the continuing assaults originated from automated assault infrastructure. Regardless, enterprise groups ought to proceed preventative measures towards these threats.
Aqua’s Crew Nautilus made intensive use of honeypots to analyze assaults within the wild, and to analyze supply-chain assaults towards cloud native functions, the crew examined photographs and packages from public registries and repositories, akin to DockerHub, NPM and Python Package deal Index. Crew Nautilus utilized Aqua’s Dynamic Menace Evaluation (DTA) product to investigate every assault. Aqua DTA is the trade’s first container sandbox resolution that dynamically assesses container picture behaviors to find out whether or not they harbor hidden malware. This allows organizations to establish and mitigate assaults that static malware scanners can’t detect.
“The important thing takeaway from this report is that attackers are extremely lively — greater than ever earlier than — and extra ceaselessly concentrating on vulnerabilities in functions, open supply and cloud know-how,” stated Morag. “Safety practitioners, builders and devops groups should hunt down safety options which can be purpose-built for cloud native. Implementing proactive and preventative safety measures will enable for stronger safety and in the end shield environments.”
To make sure cloud environments are safe, Aqua’s Crew Nautilus recommends implementing runtime safety measures, a layered strategy to Kubernetes safety, and scanning in growth.
[ad_2]
