> TritonInfoSec News
Home / Sep 29, 2026 / Story
0
#9 The Hacker News general September 28, 2026 at 11:46 UTC

Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

By [email protected] (The Hacker News)

AI Summary

The Carbonato botnet targets exposed Docker daemons to deploy the open-source Hermes Agent AI framework, overwriting its SOUL.md persona file with a 39-line malicious prompt that executes commands received via Telegram and harvests AI API keys from compromised hosts. ThreatDown researchers identified this novel abuse of an AI agent framework as a threat to cloud-exposed Docker environments, particularly those holding valuable AI service credentials.

Read full article → https://thehackernews.com/2026/09/carbonato-botnet…

Relevance score: 74.0/100

# More from September 29

  1. 1
    CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally The Hacker News
  2. 2
    Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug SecurityWeek
  3. 3
    Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation Krebs on Security
  4. 4
    ShinyHunters exploiting workarounds for Oracle PeopleSoft bug, Mandiant warns The Record
  5. 5
    Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M The Hacker News
  6. 6
    JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources The Hacker News
  7. 7
    Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon SecurityWeek
  8. 8
    New Attack Against RSA Schneier on Security
  9. 10
    Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks The Hacker News