Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Organization
ThreatDown
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 24, 2026
- Last mentionedSep 28, 2026
Timeline
5 articles · newest firstHackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
CARBONATO botnet hijacks exposed Docker servers and uses Hermes Agent for operator control.
74
Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.
74
AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.
76
New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
76
Appears with
- Carbonatomalware · 5
- Hermes Agentproduct · 5
- Dockervendor · 5
- Dockerproduct · 5
- Nous Researchorganization · 2
- Telegramproduct · 2
- Malwarebytesorganization · 1
- GH0STmalware · 1
- Gambit Securityorganization · 1
- CLOSEDQUORUMmalware · 1
- knaithethreat actor · 1
- Mistralai model · 1
- Dockerorganization · 1
- Palo Alto Networksorganization · 1
- Nous Researchvendor · 1
- Qwenai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.