Be Aware of This New Windows Container Malware “Siloscape” Targeting Kubernetes Clusters

Security researchers have uncovered the first known Windows container malware, targeting Windows Server containers to infect Kubernetes clusters in cloud environments. The malware was named ‘Siloscape’ (silo escape) because its primary goal is to escape the container. 

A researcher from Paloalto unit 42 Daniel Prizmant said, “Siloscape is heavily obfuscated malware targeting Kubernetes clusters through Windows containers. Its main purpose is to open a backdoor into poorly configured Kubernetes clusters in order to run malicious containers.”

This post will cover some heads up on Windows container vulnerabilities, an overview of Siloscape, and recommendations & best practices to stay away from such Windows container malware.

What Are Containers?

Fig #1: Windows Containers Design

Containers are a technology that allows applications to run in an isolated environment on the host machines. They are built on top of the host machine’s kernel. Although containers share the host machines’ kernel, they don’t get access to it. This feature of containers provides a lightweight, isolated environment that makes apps easier to develop, deploy, and manage without affecting other apps and services. This lightweight nature leverages better unitizations of system resources.

What Do We Know About This New Windows Container Malware: Siloscape?

Siloscape malware was first identified in March 2021 by Daniel Prizmant. Its main target is cloud applications like web servers. It is designed to gain access by exploiting the known vulnerabilities and opens a backdoor in order to run malicious containers inside the Kubernetes clusters. Its highly obfuscated code leverages Windows container escape techniques to escape the container and gain remote code execution access on the underlying node. This malware can also harvest computing resources in a Kubernetes cluster for cryptojacking and exfiltrate sensitive information from the compromised clusters.

Some common behaviors and characteristics of Siloscape malware:

The Targets of Siloscape Windows Container Malware:

Research reveals that this malware is just a small part of a larger campaign, which has been taking place for over a year. Furthermore, the report also confirmed that this campaign was active at the time of writing this post.

The actual size of the victims is unknown. However, when the researcher examines one of the C2 servers, he found 23 active victims at that time, and the server was being used to host 313 users in total.

Attack Flow of Siloscape Windows Container Malware:

Fig #2: Execution Flow of Siloscape Malware

Indicators of Compromise Captured During the Analysis of Siloscape Malware

Tips for Detecting and Removing This New Windows Container Malware “Siloscape”

Follow these recommendations to get rid of this threat:

Wrap Up:

“Unlike most cloud malware, which mostly focuses on resource hijacking and denial of service (DoS), Siloscape doesn’t limit itself to any specific goal. Instead, it opens a backdoor to all kinds of malicious activities.”. Microsoft recommends not to use Windows containers as a security feature, instead use the Hyper-V containers for anything that relies on containerization as a security boundary. We suggest migrating all Windows containers to Hyper-V containers to get rid of this new Windows container malware.