Kubernetes RBAC Exploited for Cryptomining: 2,000+ Clusters Hit
Over 2,000 Kubernetes clusters compromised through RBAC misconfigurations. Attackers deploy cryptominers via default service accounts. Check your clusters now.
Executive Summary
Aqua Security tracked a campaign compromising 2,000+ Kubernetes clusters via RBAC misconfigurations. No software vulnerability—just overprivileged service accounts granting cluster-admin access.
Technical Analysis
Attackers create backup service accounts with admin roles for persistence. Miners limit to 30% CPU during business hours and ramp up at night. Custom mining pool proxy obscures traffic. Generating ~$500K/month.
Remediation
Audit RBAC configurations. Never bind cluster-admin to default service accounts. Use namespace-scoped permissions. Check: kubectl auth can-i --list --as=system:serviceaccount:default:default
References
- Aqua Security Blog
https://blog.aquasec.com/kubernetes-rbac-cryptomining-campaign
Concerned about this threat?
Our security team can assess your exposure and recommend immediate actions.
Protect Your Organization
Find vulnerabilities like this in your systems before attackers do.
24/7 monitoring to detect and respond to threats like these in real time.
Block phishing and malware delivery targeting your organization.
Map security controls to 26 frameworks including NIST, SOC 2, and HIPAA.