Aqua’s robust container security solution provides multiple ways to protect against the DreamBus Botnet, with the simplest being Drift Prevention. We understand every environment is unique, Aqua’s Drift Prevention policy is flexible and allows you to set to Audit mode for detection only or to Enforce mode for automatic blocking.
Step-by-Step Guide
1. Enable Runtime Protection
In the Aqua Console, go to Workload Protection → Runtime Policy.
2. Define Runtime Policies
Click Add a Policy (top right) and select Container Runtime.
3. Enable Drift Prevention
Set it to Audit or Enforce to detect and block unauthorized changes to binaries, processes, or file systems.
Aqua Drift Prevention Runtime Policy
For more prevention and remediation strategies, including Aqua’s behavioral detection capabilities, visit our Support Portal.
Real Customer Experience: DreamBus Botnet Incident
A DevOps team launched their cloud native app, confident after following best practices: scanning container images for vulnerabilities, running dynamic analysis in isolated environments, and using CSPM tools to identify configuration risks.
Although some low and medium vulnerabilities were found in the web UI and microservice, they were disregarded due to negligible impact and compliance satisfaction. Dynamic scanning didn’t reveal any issues, and CSPM flagged only minor, expected configurations. Yet, within 12 hours, the DreamBus botnet exploited an exposed database with weak credentials.
Despite adhering to best practices, a misconfiguration exposed a database with weak credentials (e.g., “123456“). While static scans, dynamic analysis, and CSPM tools are vital, they don’t detect weak application-level passwords. To truly secure your cloud native applications, you need continuous runtime protection and proactive security policies that catch what other tools miss.
Don’t wait for an attack to reveal the gaps!
Contact your Aqua Sales Representative or Customer Success Manager today to learn how you can strengthen your container security and prevent real-world attacks.
For more detailed information about the DreamBus Botnet, read our blog: Stopping a DreamBus Botnet Attack with Aqua’s CNDR.
