BOSTON—June 27, 2023—Aqua Security, the pioneer in cloud native security, today published its 2023 Cloud Native Threat Report, which summarizes research and observations by Aqua Nautilus threat researchers. Based on analysis of actual attacks in the wild, the report provides security practitioners insight into threat actors’ changing tactics, techniques and procedures in order to better protect their cloud environments.
The report covers three key areas: software supply chain; risk posture, which includes vulnerabilities and misconfigurations; and runtime protection. Of the many findings, one of the most significant demonstrates that threat actors are heavily investing resources to avoid detection to establish a stronger foothold in compromised systems. Nautilus research found that — compared to findings in the 2022 Cloud Native Threat Report — there has been a 1,400% increase in fileless or memory-based attacks, which exploit existing software, applications, and protocols to perform malicious activities.
In fact, threat actors are using many techniques to conceal their campaigns. Aggregated honeypot data collected over a six-month period showed that more than 50% of the attacks focused on defense evasion. These attacks included masquerading techniques, such as files executed from /tmp, and obfuscated files or information, such as dynamic loading of code. These findings illustrate the critical importance of runtime security.
“Threat actors are more heavily focused on and increasingly successful at evading agentless solutions,” said Assaf Morag, lead threat intelligence researcher for Aqua Nautilus. “The most persuasive evidence of this was our discovery of HeadCrab, the extremely sophisticated, stealthy, Redis-based malware that compromised more than 1,200 servers. When it comes to runtime security, only agent-based scanning can detect attacks like these that are designed to evade volume-based scanning technologies, and they are critical as evasion techniques continue to evolve.”
The report also highlighted Nautilus research into software supply chain risk. The report illustrates various areas in the cloud software supply chain that can be compromised and pose a significant threat to organizations. In one specific use case, Nautilus demonstrates the implications of misconfigurations in the software supply chain and how they can lead to critical threats. This is significant because organizations of all sizes are at risk for misconfigurations and even minor misconfigurations can have a serious impact.
Ultimately, the research shows that protecting workloads with tools that understand how to interpret attacks on cloud runtime environments is crucial for ensuring the security and integrity of business data and applications.
Visit Aqua Security’s website to download the report.
About Aqua Nautilus
Aqua Nautilus focuses on cybersecurity research of the cloud native stack. Its mission is to uncover new vulnerabilities, threats and attacks that target containers, Kubernetes, serverless, and public cloud infrastructure — enabling new methods and tools to address them. With a global network of honeypots, Aqua Nautilus catches more than 80,000 cloud native attacks every month, specifically those unique to containers and microservices that other platforms cannot see.
About Aqua Security
Aqua Security stops cloud native attacks across the application lifecycle and is the only company with a $1M Cloud Native Protection Warranty to guarantee it. As the pioneer in cloud native security, Aqua helps customers reduce risk while building the future of their businesses. The Aqua Platform is the industry’s most integrated Cloud Native Application Protection Platform (CNAPP), protecting the application lifecycle from dev to cloud and back. Founded in 2015, Aqua is headquartered
in Boston, MA and Ramat Gan, IL with Fortune 1000 customers in over 40 countries. For more information, visit https://www.aquasec.com/.
