CARBONATO's payloads sat in an exposed Docker registry, and AI keys topped its loot list
ThreatDown traced a botnet through its own unauthenticated registry, recovered the implants, and found an agent persona that ranks AI API keys above every other secret on the host.