Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenSep 9, 2026
- Last mentionedSep 28, 2026
Timeline
2 articles · newest firstHackers Weaponize Agentic AI to Automate Reconnaissance, Exploitation and Post-Exploitation
Google GTIG reports threat actors using agentic AI to automate reconnaissance, exploit selection, and credential harvesting, compromising thousands of secrets.
72
Appears with
- Mandiantorganization · 1
- Dockervendor · 1
- Google Threat Intelligence Grouporganization · 1
- n8nproduct · 1
- Citrixvendor · 1
- Ministry of Finance of Thailandvictim · 1
- Hunt.ioorganization · 1
- Claude Opus 4.6ai model · 1
- DeepSeek Hermes Agentai model · 1
- Apache Tomcatproduct · 1
- NKAbusemalware · 1
- DeepSeek v4.1 Flashai model · 1
- Citrix NetScalerproduct · 1
- Deepwatchorganization · 1
- Telegramproduct · 1
- Marimoproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.