Carbonato botnet hijacks exposed Docker hosts via AI agents

Security researchers at enterprise security company ThreatDown have documented a new botnet malware called Carbonato that hijacks Docker hosts whose remote management API (application programming interface, a set of rules that lets other programs control Docker) is exposed on port 2375 without authentication. Docker is a popular platform for running software in containers, which are lightweight packages that share the host computer's resources, and many websites and online services rely on it. The malware reaches that API, tells the Docker daemon (the background service that manages containers) to launch a privileged container, which has extra permissions to access the underlying host, and then installs the Hermes Agent AI framework, a tool that lets a large language model run commands and interact with a computer. The installed agent is named GH0ST and overwrites the default SOUL.md persona file, a configuration that defines the agent's behavior. ThreatDown discovered the malware in an unauthenticated Docker registry, a storage location for Docker images that anyone can access without logging in, containing nearly 60 repositories and 4.3 GB of image data. The researchers retrieved operational evidence spanning October 2024 to August 2026, and the archive also included details about a separate campaign that distributed counterfeit cryptocurrency wallet apps.

Once connected, Carbonato opens a reverse SSH tunnel, a connection that lets an outside attacker reach the machine by having it connect out to the attacker. It installs an SSH server with the operators' key, so attackers can log in securely, and reports each new deployment through Telegram, according to ThreatDown. The malware also sets up persistence through cron jobs, systemd timers, rc.local, and OpenRC hooks, all of which are common ways to run programs automatically when a computer starts or on a schedule. This means the infection survives reboots and keeps running on the victim machine. Every newly infected host becomes part of a botnet, a network of compromised computers controlled remotely by criminals.

The most distinctive part of the attack is the use of Hermes Agent as the command and control layer. ThreatDown researchers describe an interactive command loop: the model interprets a task, writes terminal commands, reads the output, and decides what to do next. The GH0ST agent receives task commands through Telegram and can collect AI API keys, SSH credentials, access tokens, and other data, run commands on the victim, and send back the results. This design lets operators give high-level instructions instead of typing every command themselves, using the AI agent's ability to interact with the compromised host. The GH0ST agent instructions overwrite the default SOUL.md persona file, replacing the normal rules that would otherwise constrain the agent with the attacker's own instructions.

Carbonato also has worm-like spreading capability. Scripts on each infected host scan the networks attached to that host every five minutes, looking for other Docker daemons with an exposed API. When a new target is found, the malware pulls its implant from the same registry, launches the same privileged container, and enters the same persistence and scanning loop. ThreatDown could not attribute Carbonato to any known threat clusters, but based on various evidence the researchers point to Costa Rica as a possible location of the operator. The company also notes that Hermes has been abused in other malicious operations recently, including a large-scale card-skimming operation documented by cybersecurity company Gambit that stole 600,000 credit card details.

To prevent infection, ThreatDown recommends keeping Docker daemon APIs off the network and requiring authentication on registries. Organisations should watch for signs of Carbonato, including a GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145, the network identifier associated with the attackers' tunnel endpoint. These indicators can help security teams spot a compromise early. For teams running container infrastructure, AEU-I (https://aeu-i.com) provides security-first IT and infrastructure consulting that can help review how Docker daemons and registries are exposed, reducing the kind of exposure Carbonato exploits.