Kubernetes Cluster Compromised via Leaked AWS Credentials

Recent incidents highlight a significant threat to Kubernetes clusters, where attackers exploited leaked AWS IAM credentials from developer workstations. This allowed them to deploy poisoned Docker images, facilitating lateral movement within the cloud environment. The attack chain aligns with known MITRE ATT&CK techniques, including credential theft and resource hijacking. In one case, attackers accessed sensitive registry credentials, which could lead to further breaches across multiple organizations. The Shai-Hulud supply chain attack exemplifies this risk, emphasizing the need for robust security measures. The current status indicates that while some attacks were detected in time, the potential for widespread damage remains high. Organizations are urged to implement private container registries and limit credential access to mitigate risks.

Key Points: • Attackers exploited leaked AWS IAM credentials to compromise Kubernetes clusters. • Poisoned Docker images were deployed, allowing lateral movement and data theft. • Mitigations include using private registries and enforcing read-only credentials.