Poisoned image to K8s to cloud

[…] a real example of an AWS Kubernetes cluster infection through a software development supply chain compromise. The attackers were able to get AWS credentials from a DevOps workstation and use them to introduce a poisoned docker image into a Kubernetes cluster. It allowed them to move laterally within the cluster and to the cloud provider, retrieving secrets, passwords, tokens, and a bunch of other data. […] able to detect them just in time, as the attackers had retrieved secrets that would have allowed them to move laterally to other companies or execute a new docker image with nastier results.