CARBONATO

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions7
First seenSep 24, 2026
Last mentionedSep 28, 2026

Timeline

7 articles · newest first

Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts

Carbonato installs Hermes Agent on hacked Docker hosts to run Telegram commands and steal AI API keys.

Dark ReadingSep 28, 20:23 UTC · Sep 28, 2026MalwareExploited2

Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.

The Hacker NewsSep 28, 11:46 UTC · Sep 28, 2026MalwareExploited2 · 1 read

Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers

CARBONATO botnet hijacks exposed Docker servers and uses Hermes Agent for operator control.

GBHackersSep 28, 06:57 UTC · Sep 28, 2026MalwareExploited3 · 1 read

SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 1

Security Affairs launches a weekly AI-cybersecurity newsletter that indexes headlines without original reporting.

Security AffairsSep 27, 15:26 UTC · Sep 27, 2026Industry

Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers

CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.

Cyber Security NewsSep 25, 14:17 UTC · Sep 25, 2026MalwareExploited2 · 1 read

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.

Security AffairsSep 25, 09:55 UTC · Sep 25, 2026MalwareExploited2 · 1 read

New Carbonato malware uses AI agents to hijack exposed Docker hosts

Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.

BleepingComputerSep 24, 20:10 UTC · Sep 24, 2026MalwareExploited1 · 1 read

Appears with

Dockervendor · 6
Dockerproduct · 6
Hermes Agentproduct · 6
ThreatDownorganization · 5
Telegramproduct · 3
Nous Researchorganization · 2
Malwarebytesvendor · 1
DeepSeek v4.1 Flashai model · 1
Malwarebytesorganization · 1
Security Affairsorganization · 1
Hermes Agentai model · 1
GH0STmalware · 1
Gambit Securityorganization · 1
CLOSEDQUORUMmalware · 1
Claude Codeai model · 1
knaithethreat actor · 1

Entities are extracted by the model from each article. First seen Sep 24, 2026, last mentioned Sep 28, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.