Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
New AI-Powered Botnet Hijacks Exposed Docker Servers and Steals API Keys
Malware Families
Excerpt
The botnet’s instructions put AI API keys ahead of other credentials, while separate scripts handle its spread across reachable hosts. Researchers found the operation through an unauthenticated Docker registry that had been publicly exposed since May 2026. In one day of read-only collection, they recovered 59 repositories, 234 image tags and 4.3 GB of image data. The archive, spanning October 2024 to August 2026, also documented a separate operation distributing trojanized…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 45.79.183.61 | High | Score 68/100 | First seen |
| IP | 91.99.195.164 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…