Containers Everywhere: Advanced Threat Actors Heavily Leverage Them
summary
Analysis of the PurpleUrchin campaign shows a container-first criminal infrastructure: 23,000 GitHub accounts and over 1.5 million container executions via GitHub Actions workflows, 100k+ Heroku accounts and 30 cloud platforms, 300+ GB of recovered container images and 40 crypto wallets. Attackers use Colab and Docker Hub, automate browsers with xdotool, bypass a GitHub CAPTCHA via simple image-channel skew calculations, run fileless containers, and leak hard-coded credentials plus exposed ports and commit histories that lead to a Cape Town IP and the alias Christo Holloway.
AI-written summary · about
chapters (14)
- 0:00Cloud threat actors and containers
- 3:34Shared cloud security responsibility
- 7:32Container evolution and security
- 13:19Container lifecycle forensics
- 16:55Threat actors' container mistakes
- 17:15PurpleUrchin campaign overview
- 20:29GitHub CAPTCHA bypass
- 23:48Container artifact forensics
- 27:49Attacker activity timeline
- 31:15Critical mistakes leading to threat actor identification
- 34:33Play and run tactics
- 37:45Container security best practices
- 39:51Future container threats
- 40:39Question and answer session
related talks
28mWhere Are All of the Container Breaches?
29mFrom Illuminating to Eliminating Crypto Jacking Techniques in Cloud Native
35mContainers Attack and Defense
32mContainer Security: Exploits, Vulnerabilities and Defense
47mSecuring Containers By Breaking In
33mGaining initial access by exploiting leaked credentials
41mIdentifying and Mitigating Cloud and Container Threats
57mWhat vulnerabilities? Live hacking of containers and orchestrators