Detection of the intrusion before CAKETAP deployment led to a new MITRE ATT&CK entry for bind-mount hiding.
