Malware

Siloscape

Siloscape is Windows malware associated with attacks on containerized environments, particularly Windows containers in Kubernetes deployments. It is designed to run after an attacker has already obtained access to a vulnerable Windows container, then exploit a container escape weakness to break out to the underlying host. Following escape, it performs host-level actions including thread impersonation to assume the security context of a privileged service thread, aiding post-compromise execution on the host.

The malware conducts environment discovery tailored to container orchestration by searching for the kubectl binary, indicating awareness of Kubernetes administration tooling and likely interest in broader cluster access or follow-on operations. Siloscape also uses native Windows API functionality during execution and includes simple obfuscation or decryption logic, including byte-wise XOR-based decryption of protected configuration data such as command-and-control credentials.

For command and control, Siloscape has been observed using both Tor-based communications and IRC, reflecting an effort to conceal operator infrastructure while maintaining interactive control channels. Its tradecraft aligns with post-exploitation activity in cloud-native and containerized Windows environments, with emphasis on privilege escalation through container escape, host compromise, and operational anonymity.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence3

Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.

Execution

3 techniques

T1059.003Windows Command ShellEvidence4

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence2

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

T1609Container Administration CommandEvidence1

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence3

APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges. ... APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host. ... multiple groups/tools exploit various CVEs to escalate privileges.

T1134.001Token Impersonation/TheftEvidence1

T1611Escape to HostEvidence2

Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence5

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1134.001Token Impersonation/TheftEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence6

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

Discovery

3 techniques

T1069Permission Groups DiscoveryEvidence1

T1083File and Directory DiscoveryEvidence6

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1518Software DiscoveryEvidence3

"Bazar can query the Registry for installed applications"; "Dridex has collected a list of installed software on the system"; "Tropic Trooper's backdoor could list the infected system's installed software"; "Windigo has used a script to detect installed software"

Collection

1 technique

T1560Archive Collected DataEvidence1

Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence2

AsyncRAT can proxy C2 through a Tor client. Attor has used Tor for C2 communication. Cyclops Blink has used Tor nodes for C2 traffic. GreyEnergy has used Tor relays for Command and Control servers. Siloscape uses Tor to communicate with C2. WannaCry uses Tor for command and control traffic.

T1090.003Multi-hop ProxyEvidence3

During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2. APT28 has routed traffic over Tor and VPN servers to obfuscate their activities. A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.

ACTIVITY FEED

Recent activity

18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

18 SOURCESView more in app

mitre attack websiteNews

Oct 21, 2021

Updates - Updates - October 2021 | MITRE ATT&CK®

Enterprise New Software: ... Siloscape

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that decrypts its C2 password with byte-by-byte XOR and writes embedded Tor archive data to disk.

mitre attack websiteNews

Oct 21, 2021

Native API, Technique T1106 - Enterprise | MITRE ATT&CK®

Malware that uses various native API calls during operation.

mitre attack websiteNews

Oct 1, 2018

Proxy: Multi-hop Proxy, Sub-technique T1090.003 - Enterprise | MITRE ATT&CK®

Malware that communicates with command-and-control infrastructure over Tor.

+14 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Siloscape