Notifications
Clear all
Topic starter
25/06/2026 12:38 am
TL;DR: A newer Gafgyt variant is moving from IoT toward Linux-based cloud native and AI environments, using weak SSH passwords, fileless execution, and cryptomining payloads to exploit exposed compute, according to Aqua Security. Runtime policy and runtime enforcement help contain the malware, but they do not remove the underlying access and exposure gaps that let it in.
NHIMG editorial — based on content published by Aqua Security: How to Set Up Runtime Defense Against Threats Like Gafgyt
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should security teams reduce risk from weak SSH access on Linux workloads?
A: Security teams should remove password-based SSH where possible, restrict administrative sources, and treat remote shell access as a privileged pathway.
Q: Why do cloud native and AI workloads attract cryptomining malware?
A: They attract cryptomining malware because they offer high-value CPU and GPU capacity that can be monetised quickly.
Q: What do security teams get wrong about fileless malware in containers?
A: They often assume that no file on disk means no practical detection path.
Practitioner guidance
- Harden SSH as a workload identity control Inventory every exposed Linux host and remove password-based SSH where possible.
- Separate runtime detection from exposure reduction Keep container runtime protection in place to catch fileless execution, but pair it with exposure scanning so that prevention starts before the shell is opened.
- Treat cryptomining as a governance signal Alert on unexpected CPU and GPU consumption, suspicious process trees, and miner-style binaries in production.
What's in the full article
Aqua Security's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step runtime policy setup in the Aqua console for container workloads
- Specific enforcement options for blocking fileless execution and cryptocurrency mining
- A vendor walkthrough of Aqua Runtime Protection and how it flags malicious behaviour in production
- The support portal path for additional remediation guidance and policy tuning
👉 Read Aqua Security's analysis of Gafgyt runtime defense for AI workloads →
Gafgyt in cloud AI environments: what IAM and runtime teams should watch?
Explore further
25/06/2026 9:34 am
Cloud runtime security fails first at the identity boundary, not the malware boundary. The article shows a familiar pattern: weak SSH access opens the door, and only after that does runtime defense become relevant. That means the first governance failure is not the payload, but the permissive access posture that allowed a shell on a sensitive workload. Practitioners should read this as an identity exposure problem that later manifests as malware.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: Who is accountable when workload access leads to cryptomining abuse?
A: Accountability usually sits with both the platform team that exposed the access path and the security team that failed to govern it as a privileged control. If SSH, service credentials, or remote administration rights can reach production compute, those paths need the same ownership discipline as any other privileged identity.
👉 Read our full editorial: Runtime defense for Gafgyt shows why cloud AI workloads stay exposed
