Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
6 IOCs

​CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​

ThreatDown
ThreatDown
Published September 23, 2026Original Report

Malware Families

Excerpt

Threat Intelligence , Threat Walkthroughs ​CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​ ​ThreatDown​ ​researchers​ ​uncovered​ ​CARBONATO,​ ​a​ ​Docker​ ​botnet​ ​built​ ​around​ ​an​ ​AI​ ​agent​ ​that​ ​compromises​ ​exposed​ ​Docker​ ​daemons,​ ​spreads​ ​across​ ​reachable​ ​hosts,​ ​and​ ​gives​ ​operators​ ​a​ ​Telegram-controlled​ ​tool​​ for​ ​post-compromise activity.​ September 22, 2026 ThreatDown Writer In August 2026, we found an unauthenticated Docker…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTURE45.79.183.61213.136.79.115vercel.appCAPABILITYCobalt StrikeGh0st RATXMRigVICTIMunknown
Adversary
Infrastructure(6)
Capability(3)
Victim

Indicators of Compromise

Open the mindmap →

6 indicators

TypeIndicatorConfidenceScoreFirst Seen
IP45.79.183.61HighScore 68/100First seen
IP213.136.79.115HighScore 58/100First seen
Domainvercel.appMediumScore 63/100First seen
IP190.211.124.187HighScore 58/100First seen
IP91.99.195.164HighScore 68/100First seen
IP213.136.83.197HighScore 58/100First seen

IOC Relationship Graph

Building graph…