The 100-Terabyte Ghost: Unmasking a Stealth Linux DDoS Botnet Using Kernel Bind Mounts
A real-world incident response post-mortem on how two production cloud servers unknowingly transmitted over 100 Terabytes of DDoS attack traffic, and how a subtle Linux kernel trick kept the malware invisible.
Read article