Selective Memory Dump Technique for Deeper Container Forensic Analysis

Aqua Cloud Native Blog \ Tags: Runtime Security

RUNTIME SECURITY

Selective Memory Dump Technique for Deeper Container Forensic Analysis

Every attack leaves a trail, but in containerized environments, that trail can vanish before you even realize you have been attacked. Containers are short-lived, and attackers exploit this by executing malware in memory, loading hidden payloads, or deploying rootkits, then silently modifying or deleting evidence to cover their tracks. By the time security teams are …

Securing LLM Apps with Aqua: Beyond the OWASP Checklist

It started with a single LLM API call buried in a product prototype. By the time the team noticed, that call had turned into a full-blown feature. Customers were using it, business logic was being shaped by it, and the security team had not even seen it. That is the pattern we are seeing across …

SECURITY RESEARCH

Stopping Sobolan Malware with Aqua Runtime Protection

Aqua Nautilus researchers have discovered a new attack campaign targeting interactive computing environments such as Jupyter Notebooks. The attack consists of multiple stages, beginning with the download of a compressed file from a remote server. Once executed, the attacker deploys several malicious tools to exploit the server and establish persistence. This campaign poses a significant …

SECURITY RESEARCH

Hadooken Malware Targets Weblogic Applications

Aqua Nautilus researchers identified a new Linux malware targeting Weblogic servers. The main payload calls itself Hadooken which we think is referring to the attack “surge fist” in the Street Fighter series. When Hadooken is executed, it drops a Tsunami malware and deploys a cryptominer. In this blog, we explain the malware, its components, and …

SECURITY RESEARCH

Gafgyt Malware Variant Exploits GPU Power and Cloud Native Environments

Aqua Nautilus researchers discovered a new variant of Gafgyt botnet. This campaign is targeting machines with weak SSH passwords, executing 2 binaries from memory to increase the Gafgyt botnet and mine crypto currency with GPU power, indicating that the IoT botnet is targeting more robust servers running on cloud native environments. In this blog we …

CONTAINER SECURITY

Aqua: Leading the Charge in Container Security Innovation

Aqua named a leader and an outperformer in GigaOm Container Security Radar Containerization has revolutionized application development and deployment, providing enterprises with enhanced speed, agility, and consistency across different computing environments. However, this transformation introduces complexities, particularly regarding security. With the increasing adoption of containerized applications, there’s a growing demand for specialized security solutions tailored …

RUNTIME SECURITY

Combat Zero-Day Threats with Aqua’s New eBPF Lightning Enforcer

We are excited to announce the latest addition to our portfolio, our eBPF-based Aqua Lightning Enforcer. It’s designed for busy security professionals to detect zero-day attacks and sophisticated threats that occur in runtime. It utilizes eBPF technology, making it more effective, safer, and faster. The new Lightning Enforcer and our Runtime Protection solution is an …

RUNTIME SECURITY

Tracee Release: Rules Detect Attackers Out-of-the-Box

Aqua Tracee is an open source runtime security and forensics tool for Linux. It can help you detect suspicious behavior at runtime using an extensive data collection engine and a sophisticated rules engine. You can further read about the development of Tracee in our blog The Story of Tracee: The Path to Runtime Security Tool.

SECURITY RESEARCH

Detecting Drovorub’s File Operations Hooking with Tracee

Two years ago, the NSA (the United States’ National Security Agency) revealed that Drovorub, an advanced Russian malware created by the GRU 85th GTsSS team, had been discovered targeting Linux systems. Drovorub works by introducing advanced techniques which can manipulate the Linux operation system. It has an advanced kernel rootkit that hooks several kernel functions. In …

CONTAINER SECURITY

Intro to Fileless Malware in Containers

A fileless attack is a technique that takes incremental steps toward gaining control of your environment while remaining undetected. In a fileless attack, the malware is directly loaded into memory and executed, evading common defenses and static scanning.

RUNTIME SECURITY

Protecting Workloads Against Real-World Attacks With Ease

Attackers are sophisticated, there is always a lag between zero days and mitigation, and production workloads are critical. So why is the adoption of runtime security for cloud native applications still lower than shift-left security practices for the same applications?

SECURITY RESEARCH

Stopping a DreamBus Botnet Attack with Aqua’s CNDR

We recently came across a real-life scenario that is very common for organizations. A developer with admin access launched a cloud native application but made a mistake and misconfigured it with weak credentials. Just 12 hours later, the environment was attacked by the DreamBus botnet, which proceeded to evade defenses and run Kinsing malware and …

Page 1 of 312 3 Next ›

Need to secure enterprise workloads?

Aqua Cloud Native Application Protection Platform (CNAPP)

Go cloud native with the experts!

Get Demo

Aqua Security is the pioneer in securing containerized cloud native applications from development to production. Aqua's full lifecycle solution prevents attacks by enforcing pre-deployment hygiene and mitigates attacks in real time in production, reducing mean time to repair and overall business risk. The Aqua Platform, a Cloud Native Application Protection Platform (CNAPP), integrates security from Code to Cloud, combining the power of agent and agentless technology into a single solution. With enterprise scale that doesn’t slow development pipelines, Aqua secures your future in the cloud. Founded in 2015, Aqua is headquartered in Boston, MA and Ramat Gan, IL protecting over 500 of the world’s largest enterprises.

Read Aqua Security reviews on G2

Use Cases

Environments

Partners

Products

Get Started

Copyright © 2025 Aqua Security Software Ltd. Privacy Policy | Terms of Use | Cookie Policy | |