Siloscape Malware Goes After Kubernetes Clusters

Cybercriminals have been heavily focused on Kubernetes clusters over the past year. They have unleashed several large-scale campaigns and malware families, which target Kubernetes clusters. The latest malware to adopt this approach is called Siloscape. This malware has a rather interesting approach when it comes to infecting machines. Once planted, it connects to a TOR-based control server, which is being used to exfiltrate data, feed the implant commands, and more.

The exact type of Kubernetes clusters it targets are Windows containers – it relies on unpatched bugs and vulnerabilities to gain full control over the compromised network. It also attempts to find vulnerabilities in various server applications and databases in order to make the most out of its attack. Its primary focus are vulnerabilities that allow for Remote Code Execution (RCE) since this would grant it the ability to perform all sorts of tasks on the infected machine.

One of Siloscape Malware's notable traits is that it is heavily obfuscated, probably in an attempt to deter malware analysis and automatic malware detection engines. Of course, this does not make the task impossible for researchers – it just makes them spend more time trying to reverse engineer the malware's code. So far, the Siloscape Malware has infected over 300 victims in total, and there are over 20 active implants as of June 2021.

Users can protect their servers from the Siloscape Malware by applying all security patches to underlying software and services, as well as by using up-to-date antivirus software to keep their network secure.