IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE6 IOCs

​CARBONATO:​ ​a​ ​botnet​ ​built​ ​around an AI agent​

TH
ThreatDown
Published September 23, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTURE45.79.183.61213.136.79.115vercel.appCAPABILITYCobalt StrikeGh0st RATXMRigVICTIMunknown
Adversary
Infrastructure(6)
Capability(3)
Victim

Indicators of Compromise

Indicators of Compromise6

TypeIndicatorConfidenceScoreFirst Seen
IP45.79.183.61
c2intel-blogmalware
High
58
Sep 24, 26
IP213.136.79.115
c2intel-blogmalware
High
58
Sep 24, 26
Domainvercel.app
exploitindicatorintel-blog
Medium
52
Mar 26, 25
IP190.211.124.187
c2exploitintel-blog
High
58
Sep 24, 26
IP91.99.195.164
c2intel-blogmalware
High
58
Sep 24, 26
IP213.136.83.197
c2intel-blogmalware
High
58
Sep 24, 26

IOC Relationship Graph

IOC Relationship Graph6 total IOCs
IPDomain
IP5Domain1Malware3REPORT​CARBONATO:​ ​a​ ​botnet​ Cobalt StrikeGh0st RATXMRig
scroll to zoom · drag to pan · click IOC to open