Stateful detections are emerging as a critical control for cloud-native runtime security because attacks such as React2Shell and AI-assisted intrusions can escalate from vulnerability disclosure to compromise in minutes. The article also highlights the rise of JADEPUFFER, widespread adoption of stateful detections, and the growing need for trusted automated response to keep pace with agentic threat actors. #React2Shell #JADEPUFFER #Sysdig
Keypoints
- Cloud-native attacks are moving at humanly impossible speed, with exploitation occurring within hours of disclosure and some AI-assisted compromises taking only minutes.
- Sysdig Threat Research Team (TRT) observed similar rapid exploitation patterns against several vulnerabilities, including AI infrastructure tools.
- JADEPUFFER was identified as the first agentic ransomware operation to autonomously execute a destructive database extortion playbook.
- Traditional detections often lack context, creating noise and forcing analysts to manually reconstruct attacker behavior from isolated alerts.
- Stateful detections correlate multiple actions into a single higher-fidelity alert, improving signal quality and reducing false positives.
- Adoption is already broad: 70% of organizations use stateful detections, and they cover 91% of cloud environments among adopters.
- Automated response remains underused due to trust concerns; 75% of organizations have configured automation, but only 27% have it enabled.
MITRE Techniques
- [T1059 ] Command and Scripting Interpreter – The article describes attackers opening a terminal shell in a container and running commands as part of malicious activity (‘opening a shell on a container’, ‘using the kill -9 command’).
- [T1105 ] Ingress Tool Transfer – The article notes a malicious sequence where an actor opens a shell, downloads a binary to /tmp, and then executes it (‘downloading a binary to /tmp, and then executing it’).
- [T1204 ] User Execution – The example distinguishes legitimate developer activity from malicious use of a container shell, implying interaction initiated through a shell session (‘This event itself may be routine for a developer debugging a workload’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – The discussion of using kill -9 after detection and autonomous destructive activity in JADEPUFFER reflects actions that can disrupt systems and defensive visibility (‘kill a process following a threat detection alert’, ‘destructive database extortion playbook’).
- [T1486 ] Data Encrypted for Impact – JADEPUFFER is described as an agentic ransomware operation performing destructive database extortion, consistent with impact-focused encryption/extortion behavior (‘autonomously run a destructive database extortion playbook’).
Indicators of Compromise
- [File/Command names ] response actions and malicious execution context – kill -9, /tmp
- [Vulnerability/Threat names ] publicly discussed attack campaigns and operations – React2Shell, JADEPUFFER
- [Organization/Product names ] telemetry and detection context – Sysdig Threat Research Team (TRT), Falco, Sysdig Secure
- [Quantitative IOC-like telemetry ] operational metrics mentioned in the report – 70%, 91%, 75%, 27%, 140%, 28%