Cryptojacking Campaign Targeting K8s Clusters

Researchers identified a campaign leveraging the Realm C2 framework that has compromised thousands of Linux hosts between June 13-23, 2026, with a primary focus on a large managed Kubernetes clusters. The attackers exploited vulnerabilities in Argo Workflows and Gogs to gain initial access, then deployed cryptominers and used stolen Kubernetes service account tokens to spread laterally across over 300 additional nodes via privileged container escape. Organizations running Argo Workflows or Gogs should patch immediately and check for indicators of compromise.