{"schema":"hottub-news/story/v1","story":"st_cdy4fxdxnyt2kstetulq","title":"Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent","title_en":null,"outlets":2,"brief":null,"page":"https://hottub.news/stories/carbonato-botnet-compromises-docker-hosts-to-deploy-telegram-controlled-cdy4fxdxny","count":2,"items":[{"id":"n_uaucbcqjacu6xeqf6icq","seq":526352,"kind":"article","title":"Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts","url":"https://www.darkreading.com/identity-access-management-security/carbonato-botnet-ai-agent-hacked-docker-hosts","summary":"The botnet uses the open source Hermes Agent AI framework to execute commands via Telegram and steal AI API keys from exposed Docker hosts.","published":"2026-09-28T20:23:58Z","seen":"2026-09-28T21:30:19Z","lang":"en","source":{"id":"kite-darkreading-com-6b8a37","name":"darkreading.com","domain":"darkreading.com","outlet":{"wikidata":"Q68931675","name":"Dark Reading","type":"website","country":"US","designations":["business","website"]}},"via":"kite-darkreading-com-6b8a37","topics":["cybersecurity"],"authors":["Alexander Culafi"],"image":"https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blte42c5730d22cf0f1/6abab79a8ce025f8ce48d849/botnet_cyber_attack-Hengki_Lestio-GettyImages-2232351432.jpg?disable=upscale&quality=80&width=720","story":"st_cdy4fxdxnyt2kstetulq","category":"science-technology","category_p":0.8299999833106995,"sentiment":"neutral","tone":-0.27000001072883606,"political":0.07000000029802322},{"id":"n_cdy4fxdxnyt2kstetulq","seq":427423,"kind":"article","title":"Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent","url":"https://thehackernews.com/2026/09/carbonato-botnet-compromises-docker.html","summary":"Cybersecurity researchers have disclosed details of a new botnet malware called Carbonato that's targeting exposed Docker daemons to deploy an open-source artificial intelligence (AI) agent framework called Hermes Agent. \"The implant installs the framework unchanged, then overwrites its SOUL.md persona file,\" ThreatDown said. \"The 39-line prompt directs it to execute tasks received through","published":"2026-09-28T11:46:00Z","seen":"2026-09-28T12:41:53Z","lang":"en","source":{"id":"kite-feedburner-com-5fa171","name":"feedburner.com","domain":"feeds.feedburner.com"},"via":"kite-feedburner-com-5fa171","topics":["cybersecurity"],"authors":["author"],"entities":[{"id":"Q15206305","name":"Docker","type":"other"},{"id":"Q15616276","name":"Telegram","type":"other"}],"image":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3O4ih8J3-A5sGh57xyYKMGbnSqaXbWhu2g9HBE_mG11gEdedMUmYyeeYpA9TnNPwRsB4t-5V9UTW54iOR0VNzyaaa0fWhOG4Oi46KwGvrrVQRdWIDS7GX6YxjaMrA6sF9RHWNyO8gBttCQ7Nc8LUmrhhH24jSp1lPDuhok9r3CfKxgGJRObZRqRTW-5Gf/s1600/hermes-telegram.jpg","mentions":2,"story":"st_cdy4fxdxnyt2kstetulq","category":"science-technology","category_p":0.6800000071525574,"sentiment":"neutral","tone":-0.019999999552965164,"political":0.07999999821186066}]}