TLDR Tech / InfoSec
CARBONATO: a botnet built around an AI agent (6 minute read)
CARBONATO is a botnet leveraging an AI agent, spreading via unauthenticated Docker daemons. It installs the Hermes Agent, overwrites its persona for Telegram-tasked LLM sessions, and steals AI API keys and SSH credentials. ThreatDown linked operators to Costa Rica. Recommendations include securing the Docker API, detecting "GH0ST" in SOUL.md files, and rotating AI API keys.
Read the full story