Peirates

MITRE ATT&CK: S0683 View on attack.mitre.org

Aliases: Peirates

Malware type
exploit-kit
Operating systems
containers
Profile updated
2026-07-07 15:33:18

Targeted industries: technology-and-telecommunications government-and-public-sector financial-services

Context

Peirates is a post-exploitation Kubernetes exploitation framework with a focus on gathering service account tokens for lateral movement and privilege escalation. The tool is written in GoLang and publicly available on GitHub.

Detection coverage

  • 1 YARA rules
  • 88 Sigma rules

Malware & tools used

  • Container and Resource Discovery (attack-pattern)
  • Container Administration Command (attack-pattern)
  • Escape to Host (attack-pattern)
  • Application Access Token (attack-pattern)
  • Data from Cloud Storage (attack-pattern)
  • Network Service Discovery (attack-pattern)
  • Deploy Container (attack-pattern)
  • Container API (attack-pattern)
  • Cloud Storage Object Discovery (attack-pattern)
  • Cloud Instance Metadata API (attack-pattern)
  • Steal Application Access Token (attack-pattern)
  • Cloud Accounts (attack-pattern)

Used by threat actors

Detection rules

  • DITEKSHEN_INDICATOR_TOOL_PET_Peirates (yara-rule)

Reports & references

  • MITRE ATT&CK — S0683 (report)
  • github.com — Peirates (report)

External references