SCARLETEEL: Operation Leveraging Terraform, Kubernetes, and AWS for Data Theft

Originally published by Sysdig on February 28, 2023. Written by Alberto Pellitteri. The Sysdig Threat Research Team recently discovered a sophisticated cloud operation in a customer environment, dubbed SCARLETEEL, that resulted in stolen proprietary data. The attacker exploited a containerized workload and then leveraged it to perform privilege escalation into an AWS account in order to steal proprietary software and credentials. They also attempted to pivot using a Terraform state file to ot...

aws cloud customer data data theft environment escalation exploited february kubernetes privilege privilege escalation research scarleteel stolen sysdig team terraform theft threat threat research workload