1. Home
  2. Software
  3. Siloscape

Siloscape

Siloscape is malware that targets Kubernetes clusters through Windows containers. Siloscape was first observed in March 2021.[1]

ID: S0623
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows, Containers
Contributors: Daniel Prizmant, Palo Alto Networks; Yuval Avrahami, Palo Alto Networks
Version: 1.0
Created: 18 June 2021
Last Modified: 18 October 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1090 .003 代理: Multi-hop Proxy

Siloscape uses Tor to communicate with C2.[1]
Enterprise T1190 利用公开应用程序漏洞

Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.[1]

Enterprise T1140 反混淆/解码文件或信息

Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

Siloscape can run cmd through an IRC channel.[1]
Enterprise T1609 容器管理命令

Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.[1]
Enterprise T1071 应用层协议

Siloscape connects to an IRC server for C2.[1]
Enterprise T1083 文件和目录发现

Siloscape searches for the Kubernetes config file and other related files using a regular expression.[1]

Enterprise T1106 本机API

Siloscape makes various native API calls.[1]
Enterprise T1068 权限提升漏洞利用

Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.[1]
Enterprise T1069 权限组发现

Siloscape checks for Kubernetes node permissions.[1]
Enterprise T1027 混淆文件或信息

Siloscape itself is obfuscated and uses obfuscated API calls.[1]
Enterprise T1134 .001 访问令牌操控: Token Impersonation/Theft

Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.[1]
Enterprise T1518 软件发现

Siloscape searches for the kubectl binary.[1]
Enterprise T1611 逃逸至主机

Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.[1]

References

  1. Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.