Kong Ingress image shipped cryptominer

Kong had already received a November 2024 report about a Pwn Request path in the KIC repository. The active branches were changed, but old unused branches still had workflows triggered by pull_request_target. On December 23, an attacker opened a pull request against one of those branches and used it to reach CI secrets.

The attacker obtained a GitHub personal access token used by KIC automation. Kong later said the malicious payload was probably inserted through a transiently compromised GitHub Actions pipeline, not by direct theft of a DockerHub token. The attacker pushed an unauthorized image so the DockerHub :latest, :3.4, and :3.4.0 tags pointed to the compromised build.

Users reported high CPU usage on December 29. Kong reproduced the behavior on January 2 and found the public 3.4.0 image making DNS requests to subdomains of supportxmr.com. Third-party analysis concluded that the only malicious payload was XMRig. ARMO also described runtime behavior consistent with cryptomining, including high CPU use, communication with pool.supportxmr.com, and fileless execution through memfd_create.

Kong deleted the affected 3.4.0 tag, rebuilt from a clean environment, published 3.4.1, and moved clean images back under the 3.4 and latest tags. The advisory told users who pulled 3.4.0 between December 22, 2024 and January 3, 2025 to remove the image from clusters and internal registries and pull the remediated image.