Kubernetes UI Tools Turn into a Weapon

This report examines how misconfigured Kubernetes UI tools (Weave Scope, Kubernetes Dashboard, Octant) exposed on the internet can grant attackers full visibility and control over clusters—allowing shell access to pods, manipulation of deployments, and retrieval of secrets. The authors enumerated exposed instances via Shodan, observed signs of active exploitation (including TeamTNT and Tsunami-related activity), and recommend hardening, access controls, allow-listing images, runtime protections, and blocking malicious domains and binaries.