Poisoned Pipeline / Incidents / AS228

AS228 · 2024-12

Kong Ingress image shipped cryptominer

Docker / containers

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

• T0184 Harvesting sensitive information from files

supply-chain campaign

Sources

• https://github.com/Kong/kubernetes-ingress-controller/security/advisories/GHSA-58mg-ww7q-xw3p
• https://konghq.com/blog/product-releases/december-2024-unauthorized-kong-ingress-controller-3-4-0-build
• https://hackread.com/malicious-kong-ingress-controller-image-dockerhub/
• https://www.armosec.io/blog/kong-ingress-controller-cryptojacking/
• https://github.com/Kong/kubernetes-ingress-controller/issues/6907