Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments

Executive Summary

In March 2021, I uncovered the first known malware targeting Windows containers, a development that is not surprising given the massive surge in cloud adoption over the past few years. I named the malware Siloscape (sounds like silo escape) because its primary goal is to escape the container, and in Windows this is implemented mainly by a server silo.

Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers. Its main purpose is to open a backdoor into poorly configured Kubernetes clusters in order to run malicious containers.

Mehr im Blog von UNIT42 / Palo Alto Networks

https://unit42.paloaltonetworks.com/siloscape/