Siloscape

Malware Profile Updated 2 months ago
Download STIX
Preview STIX
Siloscape is a heavily obfuscated malware that emerged in 2021, specifically designed to exploit poorly configured Kubernetes clusters through Windows containers. It operates by planting backdoors within these clusters, enabling cybercriminals to steal data and user credentials. Siloscape's method involves creating a link to the host and then searching for two specific files: kubectl.exe and the Kubernetes config file, which are typically found on Kubernetes nodes. The malware uses the Tor proxy and an .onion domain to anonymously connect to its command and control (C2) server. Its unique approach includes obfuscating even simple API calls and using the Native API (NTAPI) version of the same function. In the cybersecurity landscape, Siloscape was part of a larger campaign that included other malicious software such as the Hildegard trojan, Kaiten botnet, and XMRig Monero miner, all designed to exploit similar environments. Unlike most cloud malware that focuses primarily on resource hijacking and denial of service (DoS), Siloscape does not limit itself to any specific goal, demonstrating the flexibility and potential severity of its threat. If it encounters container security measures, it will exit, highlighting the importance of robust container security to prevent significant damage. Fortunately, existing capabilities of Prisma Cloud have proven successful in detecting and mitigating the Siloscape malware. This includes blocking unzip.exe, the unzip binary Siloscape writes to the disk. The emergence and subsequent containment of Siloscape underscore the criticality of comprehensive cybersecurity measures in today's digital landscape, particularly in managing and securing Kubernetes clusters.
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Kubernetes
Exploit
Backdoor
Denial of Se...
Windows
Proxy
Tor
Botnet
Trojan
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
HildegardUnspecified
1
Hildegard is a sophisticated malware strain attributed to the cybercriminal group, TeamTNT. This malicious software primarily exploits unsecured kubelets to infiltrate and move laterally within Kubernetes clusters. The name "Hildegard" derives from the username of the tmate account utilized by the m
KaitenUnspecified
1
Kaiten, also known as Tsunami, is a malware variant that operates as a Distributed Denial of Service (DDoS) bot and an IRC bot. It targets vulnerable Internet of Things (IoT) devices and poorly protected Linux SSH servers, often being distributed alongside other DDoS bots like Mirai and Gafgyt. The
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Siloscape Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
CERT-EU
a year ago
Cryptomining and Malware Flourish on Misconfigured Kubernetes Clusters
MITRE
a year ago
Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments
DARKReading
a year ago
Combating Kubernetes — the Newest IAM Challenge
CERT-EU
a year ago
Cybersecurity threatscape: year 2021 in review