Kubernetes Clusters Under the Prime Radar of New TeamTNT Malware

Big shot multinational cybersecurity software organization globally headquartered in Japan and the United States also has regional headquarters – Europe, Asia, and North America.

The identity of the aforementioned is not hard to guess, Trend Micro Inc. The company’s history dates back to 1989 where its first seed was planted. At present times, the company’s enterprise security software mission for servers and cloud computing norms has been recognized by VMware customers, Microsoft Azure, Amazon AWS, which they provide automated security for.

Threat actors are always on the lookout for misconfigurations, especially in popular applications. When it comes to delegating the operations of deployment, scaling, and management of containerized applications, Kubernetes earns the most sought-after award. Many tools and software have been built around the most popular container orchestrator in the world, Kubernetes. Quite a number have been built towards mitigating the inevitable misconfigurations that come with Kubernetes cluster creation, scaling, and management. However, it is no news that TeamTNT has pinpointed Kubernetes servers.

This is just one among many cyberattack trends affecting the Kubernetes community. The perp, TeamTNT, has sent their malware to nearly 50,000 IPs across multiple clusters. The attacks peaked between March and May. According to this report, China (55%) had more compromised nodes in their ISP list than the rest of the world combined. The United States came next with 16%, 5% recorded in France, 4% recorded for both The United Kingdom and Germany, Canada with 3%, the remaining 13% scattered across the world.

This could be due to relatively higher numbers operating in China and the United States than other countries. Just recently, fellow cybersecurity organization, Veamm, buttressed on another ravaging cyberthreat, ransomware.

TeamTNT’s modus operandi could be related to a worm-like mannerism that is misconfigured and Kubernetes servers susceptible. Trend Micro also provided an intricate outline, talking more about the automatic networks/ports scanning and worm-like spreading of malware.

The infamous malicious actors are thought to have Kube.lateral.sh, an execute at their disposal, which can always slip through security as only a snippet of AV engines. VirusTotal can detect the executable, i.e., after the actors have disabled the Bash history, setting up the C2 server communications. All these aim to accommodate the Monero miner (XMRig), which leaves the equation later.

They also employ open source network scanning tools, masscan, Internet-scale port scanners, and Zgrab, the application layer scanner. Masscan scans exploit port 10250, which is left open as part of the kubelet API. The malware then goes for all the running pods, exploiting /run to release commands. Closing the port 10250 on running k8s clusters and protecting Kube API servers have been underlined as an effective deterrent.

Kubeadm users know that the ports listed below must be open for a cluster to function effectively.

The kubelet API port (10250) should not be exposed to the internet since it is the same as keeping your Docker Daemon API open. After getting access to the environment, TeamTNT hacks the kubelet, allowing the scans to take place inside.

According to TrendMicro, by looking at server.gofile inside the /kubelet/server package, the first thing the kube_pwn() function does is to get some information from the Kubelet API via the /runningpods endpoint, filtering the namespace, pod name and container names.