AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.
ThreatDown uncovered the CARBONATO Docker botnet after an internet-exposed container registry leaked its toolchain, including 59 repositories and 4.3 GB of images gathered in one day. Active since at least October 2024, it finds Docker daemons accepting unauthenticated connections on port 2375, starts a privileged container, and opens a reverse SSH tunnel to a relay in Costa Rica while reporting over Telegram. Persistence uses cron, systemd, rc.local, and OpenRC, with the container masquerading as systemd-resolved. It then installs Nous Research’s unmodified Hermes Agent, overwrites SOUL.md so the GH0ST persona prioritizes stealing API keys from 14 LLM providers, and uses those keys to fund its own gateway while worming to other exposed hosts.
- Active since at least October 2024; ThreatDown found an exposed attacker registry.
- Initial access uses unauthenticated Docker API on port 2375 via a privileged container.
- Unmodified Hermes Agent is steered by a 39-line SOUL.md prompt named GH0ST.
- Stolen API keys from 14 LLM providers fund the operators’ own gateway.
- Every five minutes it scans adjacent /24 networks for more exposed Docker daemons.
Full article1,191 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 25, 2026
CARBONATO exploits exposed Docker daemons, installs an AI agent, steals API keys and spreads across networks with autonomous command execution.
CARBONATO is a Docker-based botnet that has been active since at least October 2024. ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet. The registry contained the attackers’ entire toolchain and revealed details about how the botnet operates.
In just one day of passive, read-only collection, researchers gathered 4.3 GB of image data, including 59 repositories, 234 tags, and 605 verified file blobs. The registry also exposed the configuration history of the images, revealing command-and-control addresses, bot tokens, and even the shared password for the attackers’ own AI gateway.
The operation appears to be linked to Costa Rica, although researchers say the infrastructure could also be used by someone operating from elsewhere. The initial infection method is relatively simple.
The bot scans for Docker daemons accepting unauthenticated connections on port 2375, a configuration that thousands of hosts still run publicly reachable. When it finds one, it uses the Docker API itself to launch a privileged container with the host filesystem mounted, then runs commands directly on the underlying machine through that container. The host’s own daemon does most of the work.
“The container starts by running entry.sh. The script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, giving the operators a path back into the host. Its remote port is derived from the MD5 hash of the victim’s IP address, so the crew can calculate the same port whenever it needs to reconnect.” reads the report published by Threatdown. “The script also installs an SSH server, adds the crew’s key, and sends a deployment report to Telegram with the container ID, hostname, IP address, and country.”
Once in, a script opens a reverse SSH tunnel back to a relay in Costa Rica, installs an SSH server, adds the crew’s own key, and sends a deployment report to a Telegram chat. The tunnel port isn’t random: it’s derived from the MD5 hash of the victim’s IP address, so the operators can calculate which port to reconnect to without storing anything. The deployment reports are written in voseo Spanish, the regional form using “vos” instead of “tú,” which narrows the linguistic origin considerably even if it doesn’t name a country.
Persistence gets layered on through cron jobs, systemd timers, rc.local, and OpenRC, and every one of those files gets marked immutable afterward so a cleanup attempt can’t just delete them. A paired watchdog monitors the deployment and re-pulls the implant from the registry if its container disappears. The container itself runs under the name “systemd-resolved” and displays a fake systemd-networkd resolver banner, while its process arguments imitate a kernel thread called [kworker/u2:0]. A quick process review on a compromised host would see nothing obviously wrong.
The part that makes CARBONATO genuinely new is what comes after persistence is established. The implant installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, entirely unchanged.
“At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file.” the report states. “The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials.”
The attackers only modify one file: the agent’s SOUL.md persona file. This 39-line prompt renames the agent “GH0ST” and tells it what to do. The Hermes framework itself remains unchanged. The malicious behavior comes from the instructions loaded when the agent starts, making the modified agent harder to detect through the binary alone.
The instructions are straightforward. GH0ST is told to act as a post-exploitation tool, maintain persistence, and carry out commands sent by the operators through Telegram. It is also given one priority above all others.
The prompt lists 14 providers by name: OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API. It ranks those keys above SSH credentials, above access tokens, above databases. The reason becomes clear when you look at the operation’s own LLM gateway, which was still live on September 3, running on a free tier while advertising 12 models and serving 27 through its API. These operators are funding their own AI compute with stolen credentials from the machines they’ve already compromised.
The actual workflow is a loop. An operator sends a task through Telegram. Hermes Agent forwards that task, along with the SOUL.md persona, to the LLM gateway. The model writes terminal commands, reads the output, decides what to do next, and reports back to the same Telegram chat that receives deployment notifications. It’s an interactive command interface that adapts as the host reveals new information, without the operators needing to write custom tooling for each situation.
The botnet spreads without using AI. Every five minutes, a script checks the networks connected to the compromised host and its Docker bridges, then scans the surrounding /24 networks for exposed Docker daemons on port 2375. When it finds another vulnerable host, it checks whether it is already infected and, if not, deploys the malware. The new host then joins the same scanning process, allowing CARBONATO to spread across the network without further instructions from the operators.
Several clues point to Costa Rica. Fourteen of 162 image configurations contain UTC-06:00 timestamps matching the country’s timezone. The operators also use the Telegram handle “Carbo506,” while +506 is Costa Rica’s country code. In addition, the reverse SSH tunnels connect to infrastructure in AS262145, a Costa Rican network. None of these clues would be enough on its own, but together they provide stronger evidence linking the operation to Costa Rica.
“Three additional signals point toward Costa Rica. Fourteen of 162 image configurations use UTC-06:00 timestamps matching the America/Costa_Rica timezone. The Telegram handle is Carbo506, and +506 is Costa Rica’s country calling code. The reverse SSH tunnels also terminate at a sink in AS262145, a Costa Rican network.” states the report. “Each signal comes from a different part of the botnet operation: build configuration, operator identity, and active infrastructure. Taken together, they support a Costa Rica assessment for the botnet operators.”
If you’re running Docker anywhere, the fix for the infection vector is simple: don’t expose the daemon API to the network unauthenticated, and lock down every registry with authentication, because as this case shows, an open registry is simultaneously a leak and a delivery mechanism for the implant itself. For detection, don’t blocklist hermes-agent outright since it’s a legitimate package with real users. Hunt for the abuse signature instead: a /root/.hermes/SOUL.md containing “GH0ST,” a .env file carrying CARBONATO_API_KEY, or unexplained Telegram traffic leaving your servers.
And if you store AI API keys anywhere on your infrastructure, treat them the way this crew explicitly does:
“The doctrine ranks them first, so inventory where they live, rotate them, and monitor their usage.” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CARBONATO botnet)