Aqua Cloud Native Blog › Tags: Container Security Unboxed

Kaiji has been exploiting Linux-based servers and IoT devices for years. But what started as a relatively straightforward threat has evolved to become dramatically more sophisticated, employing stealthy persistence measures to stay hidden and stay planted. When dealing with a threat like Kaiji, it’s important that defenders keep pace with the tactics employed. Aqua’s Runtime …

One of the latest variants of Gafgyt targets Linux-based systems with weak SSH passwords to ultimately install cryptocurrency miners. Aqua Runtime Protection is particularly effective at defending against this variant’s use of fileless execution and its cryptomining payload, enabling enterprises to protect their critical AI infrastructure. Step-by-Step Guide 1. Create a Runtime Policy Log in …

When malware attacks like Sobolan are detected, Aqua helps security teams thoroughly analyze and mitigate these threats. Whether it is threat hunting in cloud environments or following an alert, the Aqua Hub provides logs and captured artifacts so you can see how Sobolan gained access, what processes it ran, and how it attempted to persist. …

The Aqua Platform offers full lifecycle protection for cloud native workloads, with runtime defenses designed to detect and stop threats like the Koske. As part of the platform, Aqua Secure AI extends these protections to AI-powered applications and infrastructure, helping teams monitor and mitigate emerging AI threats. From traditional malware to AI-shaped attacks, Aqua provides …

Aqua protects AI workloads against new and emerging attacks, such as code injection and jailbreak, with a complete lifecycle approach. It starts with the code, where Aqua embeds AI security directly into your secure coding practices. This includes SAST checks that identify insecure usage of AI/ML packages, all aligned with OWASP Top 10 for Large …

Aqua’s Runtime Protection acts as a powerful last line of defense when threats bypass your perimeter controls. In attacks like TeamTNT’s Docker Gatling Gun, Aqua monitors container behavior in real time to detect and stop suspicious activity such as file-less execution or resource hijacking. With flexible policies, you can automatically alert and/or block compromised containers …

Protecting against advanced malware like perfctl requires a multi-layered approach. While signature-based detection effectively identifies known variants, perfctl can evolve and evade these methods. To stay protected from future strains, combine signature-based and behavioral-based monitoring to detect suspicious and malicious unknown activity. With flexible runtime policies, you have the control to automatically stop threats like …

Aqua’s robust container security solution provides multiple ways to protect against the DreamBus Botnet, with the simplest being Drift Prevention. We understand every environment is unique, Aqua’s Drift Prevention policy is flexible and allows you to set to Audit mode for detection only or to Enforce mode for automatic blocking.   Step-by-Step Guide 1. Enable …