CARBONATO: a botnet built around an AI agent

Reported 24 Sep 2026 by otx · Severity: medium

ThreatDown researchers discovered CARBONATO, a Docker botnet that exploits exposed Docker daemons on port 2375. The operation was uncovered through an unauthenticated Docker registry exposed since May 2026, revealing two parallel activities: distribution of trojanized cryptocurre