Container instance restart triggering malicious startup logic (fr33m3)

Emiliano Mema@Nosalva

•updated Jul 16, 2026•1•0•5

Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.