Threat Research

Threat Research

Building Honeypots with vcluster and Falco: Episode II

This is part two in our series on building honeypots with Falco, vcluster, and other assorted open source tools. For...
Jason Andress | April 10th, 2024
Read More
Threat Research, Cloud Security

RUBYCARP: A Detailed Analysis of a Sophisticated Decade-Old Botnet Group
Threat Research

Cloud Threats Deploying Crypto CDN
Threat Research

SSH-Snake: New Self-Modifying Worm Threatens Networks
Cloud Security (269) Compliance (62) Kubernetes & Container Security (211) Monitoring (96) Open Source (89) Sysdig Features (158) Threat Research (98)
Filter By:
Reset Filters
Showing 12 of 97
Threat Research

Building Honeypots with vcluster and Falco: Episode II

This is part two in our series on building honeypots with Falco, vcluster, and other assorted open source tools. For...
Jason Andress | April 10th, 2024
RUBYCARP botnet group
Threat Research, Cloud Security

RUBYCARP: A Detailed Analysis of a Sophisticated Decade-Old Botnet Group

The Sysdig Threat Research Team (Sysdig TRT) recently discovered a long-running botnet operated by a Romanian threat actor group, which...
Sysdig Threat Research Team | April 9th, 2024
Threat Research

Cloud Threats Deploying Crypto CDN

The Sysdig Threat Research Team (TRT) discovered a malicious campaign using the blockchain-based Meson service to reap rewards ahead of...
Stefano Chierici | March 11th, 2024
Threat Research

SSH-Snake: New Self-Modifying Worm Threatens Networks

The Sysdig Threat Research Team (TRT) discovered the malicious use of a new network mapping tool called SSH-Snake that was...
Miguel Hernández | February 20th, 2024
Threat Research

Exploring Syscall Evasion – Linux Shell Built-ins

This is the first article in a series focusing on syscall evasion as a means to work around detection by...
Jason Andress | February 14th, 2024
Threat Research, Cloud Security

Detecting ‘Leaky Vessels’ Exploitation in Docker and Kubernetes

Summary On January 31st 2024, Snyk announced the discovery of four vulnerabilities in Kubernetes and Docker.  For Kubernetes, the vulnerabilities...
Michael Clark | February 1st, 2024
Cloud Security, Threat Research

Threat Detection on a Cloud-Native Attack Surface

Public cloud infrastructure is, by now, the default approach to both spinning up a new venture from scratch and rapidly...
Anna Belak | January 25th, 2024
Threat Research, Cloud Security

Fuzzing and Bypassing the AWS WAF

The Sysdig Threat Research Team discovered techniques that allowed the AWS WAF to be bypassed using a specialized DOM event....
Daniele Linguaglossa | January 9th, 2024
CVE-2023-38545
Threat Research, Cloud Security, Kubernetes & Container Security

CVE-2023-38545: High Severity cURL Vulnerability Detection

On Oct. 11, a new version of curl (8.4.0) was released where a couple of new vulnerabilities were fixed (CVE-2023-38545...
Miguel Hernández | October 12th, 2023
Threat Research, Cloud Security

Detecting and Mitigating CVE-2023-4911: Local Privilege Escalation Vulnerability

Recently, Qualys discovered and reported a critical vulnerability affecting the popular GLIBC ecosystem, which is installed by default on most...
Daniele Linguaglossa | October 5th, 2023
Threat Research, Cloud Security, Kubernetes & Container Security

AWS’s Hidden Threat: AMBERSQUID Cloud-Native Cryptojacking Operation

The Sysdig Threat Research Team (TRT) has uncovered a novel cloud-native cryptojacking operation which they’ve named AMBERSQUID. This operation leverages...
Alessandro Brucato | September 18th, 2023
Webinar

EMEA – The Threat Hunter’s Playbook: Mastering Cloud Defense Strategies

Join our 2023 Cloud Threat Report webinar where we will unravel the enigmatic world of weaponized cloud automation and expose cunning attacker tactics hiding among the clouds.
Sep 7, 2023 11am Pacific | 2pm Eastern
1 2 3 … 9

Subscribe to our newsletter and get the latest updates!