Aqua Blog
Expert insight, best practices and advice on cloud native security, trends, threat intelligence and compliance
container security alert

Threat Alert: Massive Cryptomining Campaign Abusing GitHub, Docker Hub, Travis CI & Circle CI

Aqua’s Team Nautilus detected an impressive campaign that set out to hijack resources to enable cryptocurrency mining. This operation focused on several SaaS software development environments, including Docker Hub, GitHub, Travis CI, and Circle CI, by abusing their automated build processes.

Continue reading ›
RedHat Marketplace

Deploy Aqua at the Speed of DevOps using Red Hat Marketplace

IBM joins the growing list of cloud vendors to develop their own e-commerce platform, as they recently developed Red Hat Marketplace. This new platform provides a digital, transactable catalog with various software listings covering both proprietary cloud services as well as solutions from independent software …

Continue reading ›
Cloud Native Security for Cloud VMs

Protecting Cloud VMs for Full-Stack Cloud Native Security

The management of Virtual Machines (VMs) in the cloud is not like anything else in your cloud native environment. Traditional host-based security methods used for VMs running on physical servers relied on agents to perform functions that simply do not exist in cloud native environments. In addition, cloud instances …

Continue reading ›
AWS Bottlerocket

Securing Container Workloads on AWS Bottlerocket

We’ve been working with Amazon Web Services (AWS) to extend the Aqua cloud native security platform to support AWS Bottlerocket — a purpose-built, Linux-based, open source OS for running containers on virtual machines or bare metal hosts — which is now GA. This combined effort ensures that AWS customers who use …

Continue reading ›
Tean TNT attack container analysis

Deep Analysis of TeamTNT Techniques Using Container Images to Attack

This blog was co-authored with Assaf Morag, Lead Security Analyst at Aqua Security

Ever notice how news about hidden malware almost always focuses on remediation AFTER the fact? So did we. Even now, there’s yet another news story about a rash of attacks by a group called TeamTNT. They used a crypto-mining worm to …

Continue reading ›

Uncover Malware Payload Executions Automatically with Tracee

We have some exciting news about two new features in Tracee, Aqua’s open source container and system tracing utility. Now, Tracee is much more than just a system call tracer, it’s a powerful tool that can be used to perform forensic investigations and dynamic analysis of binaries – both are incredibly useful when …

Continue reading ›
Self-securing-3

Achieving a Self-Securing Infrastructure in Public Clouds

One thing that most researchers look for when investigating security breaches is whether or not there’s a common element. In the case of security breaches, the kill-chain for almost every cloud security breach we looked at involved the exploitation of misconfigured or mismanaged cloud infrastructure settings. The …

Continue reading ›
cloud native security

Bringing Unconstrained Flexibility to Cloud Native Security

In the four short years since we launched Aqua and started our cloud native journey, we have all experienced dramatic change. During this time, we brought several new products to market. We witnessed the rise of Docker, then its decline. We recognized the growing popularity of Kubernetes and pivoted our …

Continue reading ›
Threat Alert Container Images

Threat Alert: Attacker Building Malicious Images Directly on Your Host

We at Team Nautilus - Aqua’s cyber security research team - discovered a new type of attack against container infrastructure. The attacker exploits a misconfigured Docker API port in order to build and run a malicious container image on the host. As far as we know, this is the first time that an attack in which the …

Continue reading ›
Risk_Based_Vulnerability_Management_v3

Risk-Based Vulnerability Management in Container Images

There’s an overwhelming number of vulnerabilities in container images – and the security of your deployments is probably suffering because of it. No matter the size of your organization, it’s a significant challenge to identify the biggest risks to your business and know what to tackle first. Merely classifying and …

Continue reading ›
Gartner Market Guide 2020

Gartner’s 2020 Market Guide to Cloud Workload Protection Platforms

If you’re looking for the reference on how to protect cloud resources, check out Gartner’s recently published Market Guide for Cloud Workload Protection Platforms* . It outlines the core capabilities and key architectural considerations that buyers must evaluate when protecting hybrid cloud workloads. In this …

Continue reading ›