Exposed Kubernetes API: Cryptojacking the Cluster
Three EKS worker nodes started pegging their CPUs overnight. The Kubernetes API server was reachable from the internet with anonymous access enabled, and an automated attacker used it to deploy a privileged DaemonSet on every node, escape the container to the host, drop a Monero miner, and steal the node IAM credentials. Work the cluster audit log, host records, perimeter egress, and CloudTrail to reconstruct the full intrusion chain.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Find the open door
20Three worker nodes started pinning CPU overnight. Nothing in the deployment pipeline matches the timing. Before anything malicious landed, something on the API plane let an outsider talk to the cluster without credentials. Determine which external IP was the first to successfully reach the cluster management endpoint without presenting any authentication.
Identify what was deployed
20Anonymous access to the API was not a dead end, it was used to deploy a workload. The attacker created a Kubernetes object that would schedule a container on every node in the cluster. Identify the name of that object as it appears in the audit log.
Trace the binary supply chain
20The container did not arrive with a miner already inside its image. It fetched the payload at runtime from a remote server. Identify the external address that served the loader script and the miner binary to the compromised node.
Name the miner
15A binary was dropped onto the node and left running. It is the process behind the sustained stratum connection and the near-100% CPU. Identify the filename of the miner binary as it appears in the host process and file-creation records.
Pin the mining destination
15The miner sends its work to a pool that collects and pays out the mined cryptocurrency. Identify the external IP address the miner connected to for its stratum session.
Map the credential theft technique
15Beyond the mining, the loader stole cloud credentials from a service every EC2-backed node can reach without leaving the host. Identify the MITRE ATT&CK sub-technique that describes harvesting credentials from that cloud metadata service.
6 tasks · 105 points total
Training Tools
Cloud Console
Cloud infrastructure logs
SIEM Console
Log analysis & SPL queries
Firewall Console
Network traffic analysis
Skills You'll Build
Requires foundational alert triage skills. Multiple data sources to correlate.
Prerequisites
- Basic understanding of security alerts
- Familiarity with Cloud concepts
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allGCP Service Account Key Abuse: IAM Privilege Escalation
A developer committed a GCP service account JSON key to a public repository and an attacker found it within hours. Work the GCP Cloud Audit Logs to trace how the leaked credential was turned into a full IAM privilege escalation and a bulk download of the production secrets vault.
AWS S3 Ransomware: SSE-C Encryption (Codefinger)
Client deliverables and backups at a professional-services firm are silently re-encrypted overnight using a legitimate AWS storage feature. No malware runs on any host. Working through CloudTrail, piece together how stolen service-account keys were used to install a countdown clock and lock every object behind a key only the attacker holds.
DarkGate via Microsoft Teams: External Message Lure
An IT helpdesk coordinator at a logistics firm receives an urgent Teams chat from an external IT support account. The message links to a VBS script disguised as a VPN update. Running it kicks off a silent MSI install that drops a renamed AutoIt3 loader, which decrypts DarkGate in memory, registers a scheduled task for persistence, and begins beaconing to an HTTPS C2 server. Trace the chain from the Teams lure through the loader to the active backdoor.