A Blast Radius Analysis of Container Attacks

Description: The data in this report is based on the identification of malicious container images that had attacked Team Nautilus honeypots. The analysis included identification of 105 hosts in the wild that were attacked by these malicious container images. We then identified additional open ports on the victims’ hosts, that could give us some insight into the types of services on the host the attackers could potentially compromise. We established a risk rank for each service we found and added them to determine the risk rank per host. We found that 36% of the hosts were vulnerable or had misconfigured services that posed a serious threat of sensitive data leak, data loss, credential leak and lateral movement across the host network.