CARBONATO Container Escape via nsenter into Host PID Namespace

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects the use of the 'nsenter' utility to target the PID 1 namespace with host-level namespace flags. This technique is used by the CARBONATO botnet to escape from a privileged Docker container and execute commands on the underlying host system, leveraging the host filesystem mount.