SandCat__2020__Red_Kangaroo.pdf

Prevasio's dynamic analysis of over 4 million Docker Hub container images reveals widespread security risks, including 6,432 malicious or potentially harmful images (0.16%) and more than 2 million images with at least one critical vulnerability. The report catalogs categories such as coinminers, hacking tools, and trojanized applications (e.g., WordPress, Apache Tomcat, Jenkins), explains the dynamic analysis approach, and emphasizes the need for runtime behavioral analysis to detect and mitigate supply-chain and runtime threats in container ecosystems.