Executive Summary
Kubernetes environments have become a primary target for sophisticated adversaries, with observed operations involving token theft increasing by 282% over the past year. High-profile actors such as the North Korean state-sponsored group Slow Pisces (Lazarus) have transitioned from traditional credential theft to exploiting Kubernetes identities as a pivot point to compromise core cloud infrastructure and financial systems. The IT sector remains the most targeted, accounting for 78% of observed activity.
Technical analysis highlights two primary vectors: the exploitation of React2Shell (CVE-2025-55182) for initial remote code execution within pods, and the systematic extraction of service account tokens (SATs) to move laterally. Attackers leverage automated tools and AI-enhanced malware like VoidLink and TeamPCP's specialized scripts to harvest credentials from /var/run/secrets/ and environment variables. Once a token is compromised, attackers enumerate the Kubernetes API to escalate privileges, often gaining full cluster or cloud-level administrative access.
This shift in tradecraft underscores the danger of over-privileged service accounts and misconfigured Role-Based Access Control (RBAC). The impact of these breaches is severe, illustrated by the theft of approximately $1.5 billion in assets. Organizations must prioritize the implementation of short-lived projected tokens, strict Pod Security Standards, and comprehensive audit log monitoring to disrupt these repeatable attack paths.