Unit 42 Details Kubernetes Token Theft and React2Shell Attacks Enabling Cloud Compromise
Summary
Unit 42 reports a 282% year-over-year rise in Kubernetes-related token-theft activity and details two attack cases involving service-account token abuse and React2Shell. The article explains cloud-pivot techniques and defensive controls.
Key points
- Unit 42 telemetry recorded a 282% year-over-year increase in Kubernetes-related token-theft alerts; the IT sector accounted for 78% of alert volume among the top 50 tenants.
- In a mid-2025 cryptocurrency exchange intrusion, Unit 42 observed a malicious pod used to expose a privileged service-account token, which enabled Kubernetes enumeration and a pivot to cloud-hosted financial systems.
- Unit 42 reports React2Shell (CVE-2025-55182) exploitation in cloud environments beginning Dec. 5–7, 2025, shortly after its Dec. 3 disclosure; attackers used code execution in workloads to access credentials and install backdoors.
- Across the cases, attackers exploited exposed applications or misconfigurations, accessed pod identities, tested permissions, and used stolen credentials to move from Kubernetes into cloud services.
- The article describes TeamPCP and VoidLink tooling for Kubernetes identity and credential discovery, and Peirates as a framework illustrating post-exploitation techniques.
- Recommended defenses include narrowly scoped RBAC, restricted Pod Security Standards, short-lived projected service-account tokens, Kubernetes audit logging, and runtime monitoring for suspicious processes and network activity.
Article Details
- Attack Vectors
- Spearphishing gave an attacker persistence on a developer workstation and access to the developer’s active privileged cloud session, which was used to deploy a malicious pod to a production Kubernetes cluster.
- A malicious pod exposed a mounted high-privilege service account token. The attacker used it to authenticate to the Kubernetes API, enumerate secrets and workloads, and deploy a backdoor.
- React2Shell (CVE-2025-55182) was exploited against public-facing React Server Components workloads. The article reports unauthenticated code execution inside Kubernetes application containers through insecure deserialization in the RSC Flight protocol.
- After gaining code execution in containers, attackers harvested mounted service account tokens and credentials from files, environment variables, and cloud metadata services, then used the credentials to pivot to cloud resources.
- Observed follow-on activity included credential and environment-variable exfiltration over outbound HTTP, backdoor installation, cryptomining, and access to cryptocurrency exchange financial infrastructure.
- Defensive Notes
- Enforce least-privilege RBAC and Restricted Pod Security Standards; limit service account permissions and isolate workloads and namespaces.
- Use short-lived, projected service account tokens bound to pod lifetimes to reduce the value of stolen credentials.
- Enable and monitor Kubernetes audit logs for unusual API requests, anonymous access, service account token use, secret enumeration, unexpected RBAC changes, and suspicious pod creation.
- Use runtime telemetry to detect unexpected shells and utilities, access to sensitive paths, unusual outbound connections, and activity consistent with cryptomining; configure automated response to terminate malicious processes or pods.
- Monitor for access to mounted service account tokens, including reads of /var/run/secrets/kubernetes.io/serviceaccount/token, and investigate use of curl or wget to transmit token data.
- Apply available protections and remediation for CVE-2025-55182, and monitor exposed workloads and cloud credentials for exploitation-related activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]238[.]149[.]198 | Listed in the article as C2 and hosting infrastructure observed in incidents. |
| IPV4 | 23[.]235[.]188[.]3 | Listed in the article as C2 and hosting infrastructure observed in incidents. |
| IPV4 | 45[.]76[.]155[.]14 | Listed in the article as C2 and hosting infrastructure; also served a backdoor-download URL. |
| SHA256 | 05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69 | Hash identified in the article for a VoidLink binary. |
| SHA256 | 7d2c9b4a3942f6029d2de7f73723b505b64caa8e1763e4eb1f134360465185d0 | Hash identified in the article for the TeamPCP proxy.sh script. |
| SHA256 | bb470a803b6d7b12fb596d2e4a18ea9ca91f40fd34ded7f01a487eed9a1d814d | Hash identified in the article for the TeamPCP kube.py payload. |
| URL | hxxp[:]//104[.]238[.]149[.]198:12349/BVN0VEdddye5odDFVR | Payload or backdoor distribution URL identified in the article as used in observed incidents. |
| URL | hxxp[:]//45[.]76[.]155[.]14/vim | Backdoor-download URL; the article says the downloaded backdoor masqueraded as a Vim editor. |
MITRE ATT&CK
T1059.004 · Unix ShellThe article describes running downloaded scripts through a shell in a Kubernetes pod, including activity to deliver secondary payloads.T1078.001 · Default AccountsThe article reports successful Kubernetes API operations by anonymous users where insecure configurations allowed unauthenticated access.T1098.006 · Additional Container Cluster RolesKubernetes audit-log guidance identifies creation or deletion of cluster role bindings as activity associated with privilege changes.T1134 · Access Token ManipulationThe article describes commands executed from Kubernetes pods using kubelet credentials and use of stolen token-based identities to access cluster resources.T1190 · Exploit Public-Facing ApplicationReact2Shell was exploited against public-facing workloads to obtain unauthenticated code execution inside application containers.T1528 · Steal Application Access TokenAttackers read mounted Kubernetes service account tokens from compromised pods and used them to authenticate to the Kubernetes API.T1552.001 · Credentials In FilesAttackers read credential files from container filesystems and exfiltrated credentials, including by encoding files and sending them over HTTP.T1552.005 · Cloud Instance Metadata APIAttackers accessed cloud metadata services to obtain credentials and pivot from Kubernetes into cloud accounts.T1552.007 · Container APIFrom compromised pods, attackers queried the Kubernetes API and enumerated secrets to discover sensitive credentials.T1609 · Container Administration CommandAttackers executed commands inside compromised Kubernetes workloads and pods.T1610 · Deploy ContainerAttackers deployed malicious pods and additional workloads, including pods used to expose service account tokens and maintain access.T1611 · Escape to HostThe article describes Peirates capabilities for using hostPath mounts or container-runtime vulnerabilities to reach Kubernetes nodes.T1613 · Container and Resource DiscoveryPost-exploitation activity included enumerating Kubernetes resources, namespaces, workloads, and service accounts to assess access and targets.
CVE
Threat Actors
Jade SleetUnit 42 connects the mid-2025 cryptocurrency exchange intrusion to a campaign of cryptocurrency heists attributed to Slow Pisces. The article describes token theft and cloud-resource abuse in related exchange operations.LazarusThe article identifies Lazarus as another name for Slow Pisces; the reported malicious activity includes cryptocurrency heists and abuse of stolen cloud identity tokens.SCARLETEELUnit 42 and others reportedly identified SCARLETEEL among groups that misused Peirates to enumerate Kubernetes resources.TeamTNTUnit 42 and others reportedly identified TeamTNT among groups that misused Peirates for reconnaissance operations.
Malware
TeamPCPThreat actors commonly reuse post-exploitation frameworks and tooling (e.g., Peirates, TeamPCP, VoidLink) to automate identity discovery, token harvesting, and cloud abuse.VoidLinkThreat actors commonly reuse post-exploitation frameworks and tooling (e.g., Peirates, TeamPCP, VoidLink) to automate identity discovery, token harvesting, and cloud abuse.
Vendors
Amazon Web ServicesIn the Bybit operation, Slow Pisces actors targeted a developer at the exchange’s multi-signature platform provider and successfully exfiltrated AWS session tokens.GCPThese tools treat the Kubernetes SAT as a launchpad for multi-cloud exploitation, exfiltrating not only the token, but also environment variables and cloud metadata to pivot across AWS, GCP and Azure.Microsoft AzureThese tools treat the Kubernetes SAT as a launchpad for multi-cloud exploitation, exfiltrating not only the token, but also environment variables and cloud metadata to pivot across AWS, GCP and Azure.Palo Alto NetworksPalo Alto Networks customers are better protected from the threats described in this article through the following products and services:
Products
Cortex CloudPalo Alto Networks Cortex Cloud provides several products which can assist organizations in protecting their Kubernetes and cloud environments.Cortex XDRFigure 6. Attempted reverse shell (CVE-2025-55182), blocked by Cortex XDR.Cortex XSIAMThe following XQL query can be used to hunt in Cortex XSIAM for specific instances of curl or wget being used to exfiltrate a service account token.KubernetesKubernetes clusters are being actively targeted to steal service account tokens and pivot from compromised pods into cloud-hosted backend systems, with token-theft activity up 282% year-over-year and the IT sectorReact Server ComponentsBy exploiting insecure deserialization in the React Server Components (RSC) Flight protocol, threat actors executed arbitrary code inside application containers running behind ingress controllers and cloud load