H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Siloscape](https://attack.mitre.org/software/S0623) is malware that targets Kubernetes clusters through Windows containers. [Siloscape](https://attack.mitre.org/software/S0623) was first observed in March 2021.(Citation: Unit 42 Siloscape Jun 2021)

Labels

malware

14 recorded

Relationships

uses

to Application Layer Protocol

Technique

uses

to Container Administration Command

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Escape to Host

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to File and Directory Discovery

Technique

uses

to Multi-hop Proxy

Technique

uses

to Native API

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Permission Groups Discovery

Technique

uses

to Software Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Windows Command Shell

Technique

2 external

References

mitre-attack

S0623

open

Unit 42 Siloscape Jun 2021

https://unit42.paloaltonetworks.com/siloscape/

open