kubectl

Reported Context (2)

The script reads K8s config files and runs kubectl. It also reads the K8s service account token from the well-known mount path, then uses the K8s API to enumerate all secrets across all namespaces. API-based enumeration TeamPCP’s LiteLLM Supply-Chain Attack Stole Credentials and Installed a Backdoor
kubectl get K8sRequiredLabels -o yaml | yq '.items[] | {"apiVersion": .apiVersion, "kind": .kind, "metadata": {"name": .metadata.name}, "spec": .spec}' > K8sAllowedRepos.yaml Research Shows How Misconfigured Kubernetes Policies Can Allow Unapproved Container Images

CVE (1)

Malware (2)

People (3)

Threat Actors (5)

MITRE ATT&CK (21)

Vendors (5)

Products (23)

Tools (6)

Industries (12)

Countries (15)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.