[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fH6E0nNCDZnYOhktEKDqufVdzt3ol4Fyp9X138oSoHcM":3},{"article":4,"iocs":48},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":32},"4314a44b-a818-4917-94cc-9fbe8f4bb937","Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts","carbonato-botnet-puts-an-ai-agent-on-hacked-docker-hosts-6c46ed","The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.","The Carbonato botnet has been observed leveraging the open source Hermes Agent AI framework to compromise Docker hosts and execute remote commands through Telegram. The malware targets exposed Docker instances to steal AI API keys and credentials, representing a convergence of botnet tactics with AI-powered automation. This campaign highlights the emerging risk of threat actors weaponizing legitimate AI frameworks against cloud infrastructure.","Carbonato botnet deploys Hermes Agent AI framework on compromised Docker hosts to steal API keys via Telegram.",null,"https:\u002F\u002Fwww.darkreading.com\u002Fidentity-access-management-security\u002Fcarbonato-botnet-ai-agent-hacked-docker-hosts","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte42c5730d22cf0f1\u002F6abab79a8ce025f8ce48d849\u002Fbotnet_cyber_attack-Hengki_Lestio-GettyImages-2232351432.jpg?width=720&quality=80&disable=upscale","2026-09-28T20:23:58+00:00","2026-09-28T22:00:24.612621+00:00",8,[18,21,24,26],{"name":19,"type":20},"Carbonato operators","threat_actor",{"name":22,"type":23},"Docker","technology",{"name":25,"type":23},"Hermes Agent AI framework",{"name":27,"type":23},"Telegram","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":11,"name":30,"slug":31},"Malware","malware",[33,38,43],{"category":34},{"id":35,"icon":11,"name":36,"slug":37},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":39},{"id":40,"icon":11,"name":41,"slug":42},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":44},{"id":45,"icon":11,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52],{"type":31,"value":50,"context":51},"Carbonato","Botnet deploying Hermes Agent AI framework on Docker hosts",{"type":31,"value":53,"context":54},"Hermes Agent","Open source AI framework abused for command execution and credential theft"]