The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

## Executive Summary This Unit 42 research demonstrates that an attacker with root on a compromised Kubernetes node can manipulate cgroup metadata to trick the SPIRE agent into issuing SPIFFE Verifiable Identity Documents (SVIDs) for co-located workloads, enabling workload impersonation; the report includes a proof-of-concept, a defensive tool called Spooffe, and mitigation guidance.