Siloscape, first known malware that drops a backdoor into Kubernetes clusters

Siloscape is a new strain of malware that targets Windows Server containers to execute code on the underlying node and spread in the Kubernetes cluster.

Researchers from Palo Alto Networks have spotted a piece of malware that targets Windows Server containers to execute code on the underlying node and then drop a backdoor into Kubernetes clusters.

Siloscape is a heavily obfuscated malware that was designed to open a backdoor into poorly configured Kubernetes clusters in order to run malicious containers and carry out malicious activities.

Compromising an entire cluster could allow an attacker to steal sensitive information, including credentials, confidential files, or even entire databases hosted in the cluster. 

“Siloscape uses the Tor proxy and an .onion domain to anonymously connect to its command and control (C2) server. I managed to gain access to this server. We identified 23 active Siloscape victims and discovered that the server was being used to host 313 users in total, implying that Siloscape was a small part of a broader campaign. I also discovered that this campaign has been taking place for more than a year.” reads the analysis published by Palo Alto Network researcher Daniel Prizmant.

The analysis of the C2 server revealed that the malware is just a small part of a larger network and that this campaign has been taking place for over a year and was still ongoing at the time of the report.

The attack chain starts through attacks on web servers and other cloud applications, then the hackers leverage container escape techniques to execute code on the underlying node, then the node’s credentials are used to spread in the cluster.

“This malware can leverage the computing resources in a Kubernetes cluster for cryptojacking and potentially exfiltrate sensitive data from hundreds of applications running in the compromised clusters,” Prizmant added.

The attacker exploits a known vulnerability or a vulnerable web page or database to achieves remote code execution (RCE) inside a Windows container, then threat actors execute Siloscape (CloudMalware.exe).

The malware impersonates CExecSvc.exe to obtain SeTcbPrivilege privileges, then creates a symbolic link to its local containerized X drive to the host’s C drive.

The malicious code searches for the kubectl.exe binary by name and the Kubernetes config file using regular expression on the host, using the global link. Next, Siloscape opens a backdoor into the cluster to conduct malicious activities.

Experts recommend avoiding use Windows containers as a security feature, using strictly Hyper-V containers for anything that relies on containerization as a security boundary. Any process running in Windows Server containers should be assumed to have the same privileges as admin on the host, which in this case is the Kubernetes node.

“Unlike most cloud malware, which mostly focuses on resource hijacking and denial of service (DoS), Siloscape doesn’t limit itself to any specific goal. Instead, it opens a backdoor to all kinds of malicious activities.” concludes the expert. “Siloscape shows us the importance of container security, as the malware wouldn’t be able to cause any significant damage if not for the container escape. It is critical that organizations keep a well-configured and secured cloud environment to protect against such threats.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Siloscape)