Threat Intelligence, Threat Walkthroughs CARBONATO: a botnet built around an AI agent ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity. September 22, 2026 ThreatDown Writer In August 2026, we found an unauthenticated Docker registry that had been publicly exposed since May.
CARBONATO: a botnet built around an AI agent
About this summary. This is a short, independently written summary of an article first published by ThreatDown. Cyber Security News did not report or verify the underlying story. Read the original: https://www.threatdown.com/blog/carbonato/
Source attribution: headline and facts are from ThreatDown (threatdown.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 115
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Gray Rabbits and…
EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight
EtherHiding Exposed: Inside a Blockchain-powered Malware Campaign Hiding in Plain Sight September 17, 2026 Jean-Pierre Mouton BLOG 15 min. This is our deep dive into how…
DarkMe RAT trades zero-days for plain phishing emails
DarkMe, a remote access trojan and info-stealer that has previously been associated with a threat group that targeted financial market traders and cryptocurrency users…
Contagious Interview: 30,000 devices infected by a fake job interview
North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview. On September 18, Japan’s National Police…
Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents
arXiv:2609.22510v1 Announce Type: new Abstract: As LLM applications integrate with external tools, they are increasingly exposed to indirect prompt injection (IPI)…
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access SOCRadar Dark Web Team identified several new underground posts, including…