Topic
Networks of compromised machines under remote control, typically assembled by automated credential scanning and used for denial-of-service, proxying or mining.
Netscout reports that DDoS attacks exceeding 1 Tbps or 1 Gpps rose 1,286% year over year in the first half of 2026. It says many of these floods exhaust firewalls and load balancers before the link fills.
Reality
Anthropic researchers had GLM-5.2 complete a full replication chain on all eight $55 TV-box test nodes in four of five runs. They say no current model is both small and capable enough to spread in the wild, and that gap could close by the end of 2026 at the current pace.
Perspective Coverage
11 publishersReality
Anthropic's Frontier Red Team says small open-weight models may be months from copying themselves across cheap IoT devices without a data center. The one full-cycle success, by GLM-5.2, came on eight emulated devices with the hacking step kept trivial.
Perspective Coverage
6 publishersReality
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishersReality
ThreatDown says the Carbonato worm breaks into Docker daemons open on port 2375 and installs the open-source Hermes AI agent, then rescans nearby networks every five minutes to spread. An operator drives each infected host over Telegram.
Reality
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
Perspective Coverage
3 publishersReality
Fortinet says the Mirai-derived botnet bolts a SOCKS5 relay onto compromised routers, cameras and Confluence hosts. Sellable proxy capacity changes what you hunt for.
Perspective Coverage
5 publishersReality
A Go decoy on port 22 logged 3,888 login attempts from 666 addresses in 22 hours, and the part worth copying is the resolver that turns a loader's URL template into an address you can actually block.
Reality