MalwareUsed by 2 actors

Peirates

Peirates is a Go-based open-source post-exploitation framework designed to help red teams and defenders understand how a compromised container can be used to explore a Kubernetes cluster, escalate privileges, and pivot into cloud services. Reported capabilities include using stolen Kubernetes service account tokens to perform operations and initiating port scans against specified IP addresses. The content also states that Peirates models Kubernetes privilege-escalation and cloud-pivot techniques, and that it has been misused previously by SCARLETEEL and TeamTNT. Its activity is associated with Kubernetes and cloud environments, particularly scenarios involving compromised containers, cluster reconnaissance, privilege escalation, and abuse of connected cloud identities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

TeamTNT

Peirates is a Go-based open-source framework, originally created to help red teams and defenders understand how a compromised container can be leveraged to explore a cluster, escalate privileges and pivot into cloud services.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

SCARLETEEL

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

Using this stolen identity, the threat actor authenticated to the Kubernetes API server, listed secrets, interacted with workloads across namespaces, and dropped a backdoor into a production pod to maintain persistent access.

T1190Exploit Public-Facing ApplicationEvidence1

This section maps observed behaviors to specific MITRE ATT&CK® techniques and tooling, illustrating how threat actors chain initial access (T1190) and token theft (T1528) to create repeatable attack paths.

Execution

3 techniques

T1204.003Malicious ImageEvidence1

Annotations ID Technique Tactic T1204.003 Malicious Image Execution Default Configuration

T1609Container Administration CommandEvidence1

Threat actors can execute commands across pods, dump tokens via kubelets, deploy malicious pods with hostPath mounts and exploit container runtime vulnerabilities to gain node-level access.

T1610Deploy ContainerEvidence1

After gaining persistence on the developer's workstation through spearphishing, the threat actor leveraged the developer’s active, privileged cloud session to deploy a malicious pod to the production Kubernetes cluster.

Persistence

1 technique

T1078Valid AccountsEvidence1

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

T1611Escape to HostEvidence1

Threat actors can execute commands across pods, dump tokens via kubelets, deploy malicious pods with hostPath mounts and exploit container runtime vulnerabilities to gain node-level access.

Stealth

1 technique

T1078Valid AccountsEvidence1

Credential Access

3 techniques

T1528Steal Application Access TokenEvidence3

Peirates can use stolen service account tokens to perform its operations.

T1552Unsecured CredentialsEvidence1

Using this stolen identity, the threat actor authenticated to the Kubernetes API server, listed secrets, interacted with workloads across namespaces...

T1552.005Cloud Instance Metadata APIEvidence1

In multiple cases, threat actors collected cloud credentials that were exposed in environment variables and cloud metadata services, using them to pivot beyond Kubernetes into the underlying cloud account.

Discovery

2 techniques

T1046Network Service DiscoveryEvidence2

The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.

T1613Container and Resource DiscoveryEvidence3

The malicious functionality was carried out using a reverse shell and abusing containers that were already running. Finding containers and nodes that could be attacked was accomplished by two tools: masscan ... and kubelet.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 years ago

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

palo alto networks unit 42 blogNews

Apr 6, 2026

Understanding Current Threats to Kubernetes Environments

A Kubernetes post-exploitation framework used to enumerate service accounts, inspect secrets, switch namespaces, query cloud metadata endpoints, steal credentials, and pivot from compromised containers into clusters and cloud services.

mitre attack websiteNews

Mar 13, 2020

Valid Accounts: Cloud Accounts, Sub-technique T1078.004 - Enterprise | MITRE ATT&CK®

A cloud attack tool that operates using stolen service account tokens.

mitre attack websiteNews

Jun 1, 2017

Network Service Discovery, Technique T1046 - Enterprise | MITRE ATT&CK®

Cloud/container-focused offensive tool that can initiate port scans against specified IP addresses.

mitre attackNews

Mar 18, 2026

Network Service Discovery, Technique T1046 - Enterprise | MITRE ATT&CK®

Malware capable of initiating port scans against specified IP addresses.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Peirates