Commando Cat campaign (Campaign)

The report describes the Commando Cat campaign that compromises vulnerable Docker instances by deploying a harmless container and escaping it (using chroot) to execute payloads on the host. Post-exploitation actions include credential theft (including cloud credentials via IMDS abuse), dropping a shell-script backdoor that can add SSH keys and create a 'games' user with a known password, modifying /etc/sudoers, and deploying a cryptocurrency miner; the campaign uses diskless techniques to avoid forensic artifacts and shows overlaps with TeamTNT-like cryptojacking operations.