Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Understanding Current Threats to Kubernetes Environments

Summary: Unit 42 telemetry shows Kubernetes-related threat actor operations, including token theft, rose 282% over the past year, with the IT sector accounting for over 78% of observed activity. The report ties this to cases including a mid-2025 cryptocurrency exchange intrusion involving a malicious pod that exposed a high-privileged service account token, and exploitation of the React2Shell vulnerability (CVE-2025-55182), disclosed Dec. 3, 2025, with earliest cloud targeting between Dec. 5 and 7, 2025.

Why it matters: A single compromised pod with an overly permissive token was enough to move from Kubernetes into the wider cloud platform and reach an exchange's financial infrastructure, and the same pattern played out at scale through React2Shell within days of disclosure.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026