Threat Research

Threat Research, Cloud Security

LLMjacking: Stolen Cloud Credentials Used in New AI Attack

The Sysdig Threat Research Team (TRT) recently observed a new attack that leveraged stolen cloud credentials in order to target...
Alessandro Brucato | May 6th, 2024
Read More
Threat Research

Meet the Research behind our Threat Research Team
Threat Research

Building Honeypots with vcluster and Falco: Episode II
Threat Research, Cloud Security

RUBYCARP: A Detailed Analysis of a Sophisticated Decade-Old Botnet Group
Cloud Security (279) Compliance (65) Kubernetes & Container Security (213) Monitoring (97) Open Source (90) Sysdig Features (160) Threat Research (99)
Filter By:
Reset Filters
Showing 85-96 of 98
Muhstik malware
Threat Research, Kubernetes & Container Security

Hands-On Muhstik Botnet: crypto-mining attacks targeting Kubernetes

Malware is continuously mutating, targeting new services and platforms. The Sysdig Security Research team has identified the famous Muhstik Botnet...
Stefano Chierici | November 16th, 2021
Shellbot malware
Threat Research

Malware analysis: Hands-On Shellbot malware

Malware analysis is a fundamental factor in the improvement of the incident detection and resolution systems of any company. The...
Alberto Pellitteri | November 2nd, 2021
Threat Research, Kubernetes & Container Security

Threat news: Tsunami malware mutated. Now targeting Jenkins and Weblogic services

The Tsunami malware is back! Although it appeared for the first time several years ago, the Sysdig Research Team has...
Alberto Pellitteri | October 26th, 2021
cve-2021-25741 kubelet falco-00
Threat Research, Kubernetes & Container Security

How to mitigate kubelet’s CVE-2021-25741: Symlink exchange can allow host filesystem access

CVE-2021-25741 is a new vulnerability discovered in Kubernetes that allows users to create a container with subpath volume mounts to...
Alberto Pellitteri | September 24th, 2021
Artistic representation of the Sysrv-Hello Botnet puppeteering WordPress pods. Clearly a reference to the puppeteer in the Fantastic 4.
Threat Research, Kubernetes & Container Security, Open Source

THREAT ALERT: Crypto miner attack – Sysrv-Hello Botnet targeting WordPress pods

The Sysdig Security Research team has identified a Cryptominer attack hitting a Kubernetes pod running WordPress, related to the recent...
Stefano Chierici | August 26th, 2021
Open Source, Kubernetes & Container Security, Threat Research

How to mitigate CVE-2021-33909 Sequoia with Falco – Linux filesystem privilege escalation vulnerability

The CVE-2021-33909, named Sequoia, is a new privilege escalation vulnerability that affects Linux’s file system. It was disclosed in July,...
Alberto Pellitteri | July 28th, 2021
Falco and Prometheus can help detect new crypto mining attack targeting Kubeflow and TensorFlow
Threat Research, Cloud Security, Kubernetes & Container Security, Open Source

Detecting new crypto mining attack targeting Kubeflow and TensorFlow

Microsoft has discovered a new large-scale attack targeting Kubeflow instances to deploy malicious TensorFlow pods, using them to mine Monero...
Stefano Chierici | June 30th, 2021
Threat Research, Kubernetes & Container Security, Open Source

Detecting and Mitigating CVE-2021-25737: EndpointSlice validation enables host network hijack

The CVE-2021-25737 low-level vulnerability has been found in Kubernetes kube-apiserver where an authorized user could redirect pod traffic to private...
Stefano Chierici | May 24th, 2021
Open Source, Kubernetes & Container Security, Threat Research

Exploiting and detecting CVE-2021-25735: Kubernetes validating admission webhook bypass

The CVE-2021-25735 medium-level vulnerability has been found in Kubernetes kube-apiserver that could bypass a Validating Admission Webhook and allow unauthorised...
Stefano Chierici | April 28th, 2021
Threat Research, Kubernetes & Container Security, Open Source

Mitigating CVE-2021-20291: DoS affecting CRI-O and Podman

The CVE-2021-20291 medium-level vulnerability has been found in containers/storage Go library, leading to Denial of Service (DoS) when vulnerable container...
Stefano Chierici | April 16th, 2021
Threat Research, Kubernetes & Container Security

Detecting and mitigating Apache Unomi’s CVE-2020-13942 – Remote Code Execution (RCE)

CVE-2020-13942 is a critical vulnerability that affects the Apache open source application Unomi, and allows a remote attacker to execute...
Stefano Chierici | March 10th, 2021
Threat Research, Kubernetes & Container Security, Open Source

How to detect sudo’s CVE-2021-3156 using Falco

A recent privilege escalation heap overflow vulnerability (CVSS 7.8), CVE-2021-3156, has been found in sudo. sudo is a powerful utility...
Stefano Chierici | January 28th, 2021
1 … 6 7 8 9

Subscribe to our newsletter and get the latest updates!