Back to all scenarios
Scenario #297
Security
Kubernetes v1.25, GKE
Malicious Init Container Used for Reconnaissance
A pod was launched with a benign main container and a malicious init container that copied node metadata.
Find this helpful?
What Happened
Init container wrote node files (e.g., /etc/resolv.conf, cloud instance metadata) to an external bucket before terminating.
Diagnosis Steps
- 1Enabled audit logs for object storage.
- 2Traced writes back to a pod with suspicious init container.
- 3Reviewed init container image – found embedded exfil logic.
Root Cause
Lack of validation on init container behavior.
Fix/Workaround
• Blocked unknown container registries via policy.
• Implemented runtime security agents to inspect init behavior.Lessons Learned
Init containers must be treated as full-fledged security risks.
How to Avoid
- 1Verify init container images and registries.
- 2Use runtime tools (e.g., Falco) for behavior analysis.