Threat actors can establish persistence on compromised clusters even after addressing the initial access misconfiguration by exploiting RBAC to enforce malicious access control policies. An Aqua Security team named ‘Nautilus’ made a discovery of this new type of attack, which they called ‘RBAC Buster.’ It has been reported that 60 misconfigured Kubernetes clusters were compromised as a result of this campaign.

Read full article on GBHackers