CARACAL

Summary from the TLDR InfoSec newsletter

Caracal is a Rust-based implementation of eBPF techniques. It can hide target BPF programs and maps, making them invisible to tools like bpftop and bpftool. Additionally, it can conceal processes, rendering them undetectable by commands such as ps, top, and ls /proc, and is resistant to certain brute-force methods for uncovering them.