Incident Library

Organisation

Aqua Security

Aqua Security · aqua-security

1 case · 2023

Root cause Configuration change
Component Kubernetes API serverRBAC and service accountsContainer registry and its credentials
Contributing factor Monitoring blind spot
Symptom Resources deletedUnauthorised access or a foreign workload

Cases

  1. IL-0068 Anonymous access to the Kubernetes API server used to plant a ClusterRoleBinding backdoor and a cryptominer DaemonSetAqua Security · 2023

    Root cause Configuration change