Actively exploited

Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts

Why it matters: The way in is a Docker API answering on port 2375 with no authentication; once inside, the open-source Hermes agent takes orders over Telegram and goes after AI provider API keys first.

Check if your host exposes the Docker API (port 2375)

Covered by 2 outlets

  • Dark Reading - Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts ()
  • The Hacker News - Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent ()

Published

Start with real signal

See your security surface before you subscribe.

Run the complete AYAsec workflow on Free, then move to the cadence your team needs.

Start scanning free