The Anatomy of Cloud Attacks
summary
A cloud honeypot records 250,000 attacks last year and a 50% attack increase, revealing three operations: Kinsing mounts memory‑only payloads, kills competitors, uses over 75 vectors and a rootkit to run a crypto miner; TeamTNT abuses misconfigured docker run to deploy prebuilt scanners and a Tsunami IRC C2, harvests AWS/Azure/GCP credentials and uses Pacu for escalation; HeadCrab exploits exposed Redis via SLAVEOF and custom Lua commands for semi‑fileless persistence. Tracee, Trivy, Kube‑Hunter and account segregation prove effective mitigations.
AI-written summary · about
chapters (8)
- 0:00Cloud attack research intro
- 6:34Threat intelligence curation
- 10:57Kinsing attacker profile
- 17:38TeamTNT attacker profile
- 25:35HeadCrab attacker profile
- 33:14Comparing the three attackers
- 36:47Key lessons learned
- 43:45Q&A
related talks
39mReal-World Detection Evasion Techniques in the Cloud
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
18mSecuring cloud innovation: Lessons learned
34mFollow the Dynamite: Commemorating TeamTNT's Cloud Attacks
50mInsights into New Supply Chain and Cloud-Identity Attacks
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting
29mFrom Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native
33mCloud Hacking Scenarios