Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials
Malware Families
Excerpt
The malware spreads automatically across reachable networks, while its operators use Telegram to direct activity on compromised systems. The discovery began with an unauthenticated Docker registry exposed to the internet. In one day of read-only collection, researchers recovered 59 repositories, 234 image tags and 4.3 GB of data. The archive, dating from October 2024 to August 2026, revealed both the botnet and a separate operation distributing trojanized cryptocurrency…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 45.79.183.61 | High | Score 68/100 | First seen |
| IP | 91.99.195.164 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…