K-IMAGE-BACKDOORPersistence

Backdoored Container Image

Push a backdoored image with a benign tag to the cluster's registry — wait for the deployment to pull it on next rollout.

§ Where this technique fits

K-IMAGE-BACKDOOR is catalogued under the Persistence tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

CVE-2024-21626 (Leaky Vessels) → container escape
Outdated runc lets a malicious image escape during 'docker build' or 'docker run' via a leaked file descriptor pointing at the host filesystem.
step 3 / 5

§ What commonly comes next

01
Privileged Container Escape
K-PRIV-CONTAINER · Privilege Escalation
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

CVE-2024-21626 (Leaky Vessels) → container escape

§ What commonly comes next