CARBONATO (Malware): news timeline & CVEs

Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers

CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.

ThreatDown describes CARBONATO, a botnet that compromises Docker daemons left exposed to the internet without authentication, starts a privileged container, and gains host access. It opens a reverse SSH tunnel, persists through cron, systemd, and related mechanisms, and every five minutes scans attached /24 ranges for more exposed Docker services. Operators install the unmodified Hermes Agent with a short persona that collects AI API keys, SSH credentials, tokens, and database secrets, then runs commands from tasks sent over Telegram. Researchers recovered an exposed registry with 59 repositories and about 4.3 GB of images spanning October 2024 to August 2026; clues point toward Costa Rica, but attribution is not confirmed.

Cyber Security NewsSep 25, 14:17 UTC · 1d agoMalware in the wild 3 sources

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.

ThreatDown uncovered the CARBONATO Docker botnet after an internet-exposed container registry leaked its toolchain, including 59 repositories and 4.3 GB of images gathered in one day. Active since at least October 2024, it finds Docker daemons accepting unauthenticated connections on port 2375, starts a privileged container, and opens a reverse SSH tunnel to a relay in Costa Rica while reporting over Telegram. Persistence uses cron, systemd, rc.local, and OpenRC, with the container masquerading as systemd-resolved. It then installs Nous Research’s unmodified Hermes Agent, overwrites SOUL.md so the GH0ST persona prioritizes stealing API keys from 14 LLM providers, and uses those keys to fund its own gateway while worming to other exposed hosts.

Security Affairsupdated Sep 25, 14:17 UTC · 1d agofirst Sep 25, 09:55 UTC · 2d agoMalware in the wild 3 sources

New Carbonato malware uses AI agents to hijack exposed Docker hosts

Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.

Malwarebytes ThreatDown researchers uncovered Carbonato, a worm-like botnet that compromises Docker hosts exposing an unauthenticated API on port 2375. The malware launches a privileged container, opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and persists via cron, systemd timers, rc.local, and OpenRC. It installs the Hermes Agent framework under a GH0ST persona that receives Telegram tasks to collect AI API keys, SSH credentials, and tokens, then runs commands and returns results. Implants came from an open registry of nearly 60 repositories and 4.3 GB of images, with activity from October 2024 to August 2026; attribution is unconfirmed, with Costa Rica a possible operator location.

BleepingComputerupdated Sep 25, 14:17 UTC · 1d agofirst Sep 24, 20:10 UTC · 2d agoMalware in the wild 3 sources

CARBONATO

Timeline3 articles

Appears with

Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers

AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway

New Carbonato malware uses AI agents to hijack exposed Docker hosts