Poisoned Pipeline / Techniques / T0139
Resource hijacking
Resource hijacking is a significant threat to cloud and container security.
It refers to the unauthorized use of computing resources, such as CPU power, memory, and bandwidth, by an attacker who has gained control over a system or network.
In cloud environments, attackers can compromise cloud-based systems to perform resource-intensive tasks like cryptocurrency mining, DDoS attacks, and other malicious activities.
This can significantly impact system availability and negatively affect hosted services.
Attackers can also leverage cloud-based resources to launch attacks on other targets, amplifying the impact of their actions.
Similarly, in containerized environments, attackers can use compromised containers to launch resource-hijacking attacks.
By deploying multiple containers within a cluster or environment, attackers can scale their mining activities and launch coordinated DDoS attacks.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1550 Implement strict access control for clouds
- M1720 Implement regular patches and updates
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1260 Implement regular security audit and review
- D1261 Implement penetration testing
- D1262 Implement vulnerability assessment
- D1510 Implement Intrusion Detection System and anti-malware
Observed in incidents (9)
- npm event-stream / flatmap-stream
- JuiceStealer PyPI phishing and typosquats
- PyPI SymPy impersonation cryptominer
- DPRK Contagious Interview (BeaverTail / npm + git)
- GemStuffer RubyGems campaign abused RubyDoc.info builders
- Deep-Live-Cam malicious git dependency
- Ultralytics PyPI compromise
- npm chalk / debug maintainer phishing (Qix)
- ua-parser-js npm account takeover