I don't think these images made a point of trying to disguise themselves. They were meant to be used in already compromised hosts and pulled after the fact. One

I don't think these images made a point of trying to disguise themselves. They were meant to be used in already compromised hosts and pulled after the fact. One of the reasons why containers/k8s are so attractive for malware like this is that they are spun up/down all the time. Without actively scanning for IoCs it's very easy to overlook.