CARBONATO Hermes Agent AI API Key Loot Stored in /root/.hermes/loot/

Ibrahim Saud@tektrix

•updated 7 days ago•0•0•0

Detects unauthorized file creation within the /root/.hermes/loot/ directory and specific path combinations associated with the CARBONATO botnet's Hermes Agent. This activity is indicative of credential harvesting, specifically the exfiltration of AI API keys for various LLM providers.