Kong Ingress image shipped cryptominer
An attacker used a pull_request_target workflow weakness on an old Kong Ingress Controller branch to steal CI secrets and publish an unauthorized DockerHub image for version 3.4.0.
Story
Kong had already received a November 2024 report about a Pwn Request path in the KIC repository. The active branches were changed, but old unused branches still had workflows triggered by pull_request_target. On December 23, an attacker opened a pull request against one of those branches and used it to reach CI secrets.
The attacker obtained a GitHub personal access token used by KIC automation. Kong later said the malicious payload was probably inserted through a transiently compromised GitHub Actions pipeline, not by direct theft of a DockerHub token. The attacker pushed an unauthorized image so the DockerHub :latest, :3.4, and :3.4.0 tags pointed to the compromised build.
Users reported high CPU usage on December 29. Kong reproduced the behavior on January 2 and found the public 3.4.0 image making DNS requests to subdomains of supportxmr.com. Third-party analysis concluded that the only malicious payload was XMRig. ARMO also described runtime behavior consistent with cryptomining, including high CPU use, communication with pool.supportxmr.com, and fileless execution through memfd_create.
Kong deleted the affected 3.4.0 tag, rebuilt from a clean environment, published 3.4.1, and moved clean images back under the 3.4 and latest tags. The advisory told users who pulled 3.4.0 between December 22, 2024 and January 3, 2025 to remove the image from clusters and internal registries and pull the remediated image.
Affected Artifacts
- Observed
- 2024-12-23 to 2025-01-03
- Compromised Versions
- Fixed
- 3.4.1
- Hashes
-
- sha256:a00659df0771d076fc9d0baf1f2f45e81ec9f13179f499d4cd940f57afc75d43
- sha256:4e3bbca1ba0bf9f0d53c8b1cc07bf92d9b1d41b3f066fdf4aec7cdd8c21ca3b7
- sha256:e164e6e21c661679c556d16638300c25e16d86bb2d567ad66b4181f1a65f4788
- +1 more
- Evidence
- distribution: hub.docker.com/layers/kong/kubernetes-ingress-controller/3.4.0/images/sha256-a00659df0771d076fc9d0baf1f2f45e81ec9f13179f499d4cd940f57afc75d43, docker://docker.io/kong/kubernetes-ingress-controller:3.4.0@sha256:a00659df0771d076fc9d0baf1f2f45e81ec9f13179f499d4cd940f57afc75d43, mirror: github.com/r0binak/kong-xmrig, ghsa: GHSA-58mg-ww7q-xw3p , +11 more
- Kong reported that the unauthorized image was downloaded 202 times.
- Kong's fixed image hashes for 3.4.0 were sha256:b358296fa6a1458c977c0513ff918e80b708fa9d7721f9d438f3dfce24f60f4f for AMD64 and sha256:e0125aa85a4c9eef7822ba5234e90958c71e1d29474d6247adc3e7e21327e8ee for ARM64; these are clean replacement hashes, not malicious hashes.
- Kong reported no evidence that any other images before or after the malicious hash were affected.
Incident Context
- Motive
- Financial Gain
- Attribution
- Person
- Cause
- CI/CD Exploit
- Transitive
- No
- Actor
- Individual Hacker
- User Impact
- 202
External References
- Unauthorized image of Kong Ingress Controller v.3.4.0github.com
- December 2024 Unauthorized Kong Ingress Controller 3.4.0 Buildkonghq.com
- Malicious Kong Ingress Controller Image Found on DockerHubhackread.com
- Tackling the recent Kong ingress controller security incident with ARMO's behavioral CADRarmosec.io
- Kong-ingress-controller 3.4 has high CPU usage when running 2 podsgithub.com
Source record: oss/attacks/kong-ingress-controller/meta.yaml