Aqua Blog

Advanced malware protection

Detecting Malicious Activity in CI/CD Pipeline with Tracee

Detecting Malicious Activity in CI/CD Pipeline with Tracee

With the growing popularity of CI platforms to build software, bad actors are increasingly looking to exploit these environments to target organizations. In our post about the recent Codecov breach, we explored how an attacker was able to get access to credentials from within the CI/CD pipeline. To prevent this from …

Continue reading ›
Threat Alert: Monero Miners Target Cloud Native Dev Environments

Threat Alert: Monero Miners Target Cloud Native Dev Environments

In September 2020, Aqua’s Team Nautilus detected a campaign that targeted the automated build processes of GitHub and Docker Hub. At that time we notified the affected services and they blocked the attack. Now, this campaign has resurfaced with vengeance. In just four days, the attackers set up 92 malicious Docker Hub …

Continue reading ›
Threat Alert: TeamTNT Pwn Campaign Against Docker and K8s Environments

Threat Alert: TeamTNT Pwn Campaign Against Docker and K8s Environments

Last week, TeamTNT launched a new campaign against Docker and Kubernetes environments. Using a collection of container images that are hosted in Docker Hub, the attackers are targeting misconfigured docker daemons, Kubeflow dashboards, and Weave Scope, exploiting these environments in order to steal cloud credentials, …

Continue reading ›
Scan Container Images for Vulnerabilities & Hidden Malware with Aqua Wave

Scan Container Images for Vulnerabilities & Hidden Malware with Aqua Wave

With an ever-evolving threat landscape, bad actors increasingly target container infrastructure, installing sophisticated malware into images that changes its behavior to evade detection. As static scanning is not designed to spot such advanced threats, it's critical to perform dynamic analysis to detect suspicious …

Continue reading ›
Threat Alert: TeamTNT is Back and Attacking Vulnerable Redis Servers

Threat Alert: TeamTNT is Back and Attacking Vulnerable Redis Servers

Over the past few weeks, TeamTNT grabbed headlines after launching several novel attacks against cloud native infrastructure. In response, Docker Hub decided to remove TeamTNT’s malicious images from its community and deleted the user 'Hildeteamtnt.' But just a few days later, TeamTNT reemerged with a catchy logo …

Continue reading ›
Uncover Malware Payload Executions Automatically with Tracee

Uncover Malware Payload Executions Automatically with Tracee

We have some exciting news about two new features in Tracee, Aqua’s open source container and system tracing utility. Now, Tracee is much more than just a system call tracer, it’s a powerful tool that can be used to perform forensic investigations and dynamic analysis of binaries – both are incredibly useful when …

Continue reading ›
Threat Alert: An Attack Against a Docker API Leads To Hidden Cryptominers

Threat Alert: An Attack Against a Docker API Leads To Hidden Cryptominers

Following an attack against a misconfigured Docker API port, the research team at Aqua Security performed an in-depth examination of the Docker Hub account from which the image was pulled. The examination was done by dynamically scanning for hidden threats in the container images hosted in that specific Docker Hub …

Continue reading ›
Dynamic Threat Analysis for Container Images: Uncovering Hidden Risks

Dynamic Threat Analysis for Container Images: Uncovering Hidden Risks

This blog was co-written with Idan Revivo, head of Aqua's cyber research team

Container images are a growing path for external code to enter an organization. Docker has simplified image workflow in order to encourage adoption by developers, so anyone can pull and run images that were built and pushed to Docker Hub, …

Continue reading ›