Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
CARBONATO: a botnet built around an AI agent
Malware Families
Excerpt
Threat Intelligence , Threat Walkthroughs CARBONATO: a botnet built around an AI agent ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI agent that compromises exposed Docker daemons, spreads across reachable hosts, and gives operators a Telegram-controlled tool for post-compromise activity. September 22, 2026 ThreatDown Writer In August 2026, we found an unauthenticated Docker…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 45.79.183.61 | High | Score 68/100 | First seen |
| IP | 213.136.79.115 | High | Score 58/100 | First seen |
| Domain | vercel.app | Medium | Score 63/100 | First seen |
| IP | 190.211.124.187 | High | Score 58/100 | First seen |
| IP | 91.99.195.164 | High | Score 68/100 | First seen |
| IP | 213.136.83.197 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…