IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE2 IOCs

CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials

CP
Cyber Press
Published September 25, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTURE45.79.183.6191.99.195.164CAPABILITYGh0st RATVICTIMunknown
Adversary
Infrastructure(2)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise2

TypeIndicatorConfidenceScoreFirst Seen
IP45.79.183.61
c2intel-blogmalware
High
68
Sep 24, 26
IP91.99.195.164
c2intel-blogmalware
High
68
Sep 24, 26

IOC Relationship Graph

IOC Relationship Graph2 total IOCs
IP
IP2Malware1REPORTCARBONATO Botnet Uses AI AGh0st RAT
scroll to zoom · drag to pan · click IOC to open