Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent

The Carbonato botnet exploits unsecured Docker daemons to install the Hermes AI agent, controlled via Telegram, enabling remote command execution and credential theft. It spreads autonomously by scanning networks for vulnerable Docker hosts and maintains persistence through system masquerading and cron jobs.