[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH6E0nNCDZnYOhktEKDqufVdzt3ol4Fyp9X138oSoHcM":3},{"article":4,"iocs":48,"watch_terms":55,"solutions":56,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"4314a44b-a818-4917-94cc-9fbe8f4bb937","Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts","carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-6c46ed","The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.","The Carbonato botnet has been observed leveraging the open source Hermes Agent AI framework to compromise Docker hosts and execute remote commands through Telegram. The malware targets exposed Docker instances to steal AI API keys and credentials, representing a convergence of botnet tactics with AI-powered automation. This campaign highlights the emerging risk of threat actors weaponizing legitimate AI frameworks against cloud infrastructure.","Carbonato botnet deploys Hermes Agent AI framework on compromised Docker hosts to steal API keys via Telegram.","https:\u002F\u002Fwww.darkreading.com\u002Fidentity-access-management-security\u002Fcarbonato-botnet-ai-agent-hacked-docker-hosts","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte42c5730d22cf0f1\u002F6abab79a8ce025f8ce48d849\u002Fbotnet_cyber_attack-Hengki_Lestio-GettyImages-2232351432.jpg?width=720&quality=80&disable=upscale","2026-09-28T20:23:58+00:00","2026-09-28T22:00:24.612621+00:00",8,[17,20,23,25],{"name":18,"type":19},"Carbonato operators","threat_actor",{"name":21,"type":22},"Docker","technology",{"name":24,"type":22},"Hermes Agent AI framework",{"name":26,"type":22},"Telegram","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52],{"type":31,"value":50,"context":51},"Carbonato","Botnet deploying Hermes Agent AI framework on Docker hosts",{"type":31,"value":53,"context":54},"Hermes Agent","Open source AI framework abused for command execution and credential theft",[],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":88,"name":89,"problem":90,"products":91},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":117,"name":118,"problem":119,"products":120},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":163},"ai-powered-botnet-exploits-exposed-docker-hosts-to-steal-credentials","AI-Powered Botnet Exploits Exposed Docker Hosts to Steal Credentials","The Carbonato botnet campaign exploits Docker hosts that have been left exposed to the internet without proper access controls or network restrictions, allowing attackers to deploy the Hermes AI Agent framework and execute commands remotely via Telegram. The root cause is a failure in configuration management — Docker APIs should never be publicly accessible without authentication and strict firewall rules. What makes this campaign particularly dangerous is the weaponization of legitimate AI frameworks, enabling automated, scalable attacks that can rapidly harvest API keys and cloud credentials. Stolen AI API keys can lead to significant financial losses, data breaches, and further lateral movement within cloud environments, compounding the damage well beyond the initial compromise.",[151,152,153,154,155,156,157,158,159,160,161,162],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-190: Application Container Security Guide","NIST CM-6: Configuration Settings","NIST AC-3: Access Enforcement","NIST SI-4: System Monitoring","NIST IA-5: Authenticator Management","MITRE ATT&CK T1610: Deploy Container","MITRE ATT&CK T1552: Unsecured Credentials","Docker CIS Benchmark v1.6",{}]