Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.
ThreatDown describes CARBONATO, a botnet that compromises Docker daemons left exposed to the internet without authentication, starts a privileged container, and gains host access. It opens a reverse SSH tunnel, persists through cron, systemd, and related mechanisms, and every five minutes scans attached /24 ranges for more exposed Docker services. Operators install the unmodified Hermes Agent with a short persona that collects AI API keys, SSH credentials, tokens, and database secrets, then runs commands from tasks sent over Telegram. Researchers recovered an exposed registry with 59 repositories and about 4.3 GB of images spanning October 2024 to August 2026; clues point toward Costa Rica, but attribution is not confirmed.
- Spreads through unauthenticated Docker APIs using privileged containers.
- Hermes Agent persona collects secrets and runs Telegram-delivered tasks.
- Scripts, not the agent, scan nearby /24 ranges and redeploy the implant.
- Exposed registry yielded 59 repositories and roughly 4.3 GB of images.
- ATT&CK
- T1133 External Remote ServicesT1610 Deploy ContainerT1021.004 SSHT1046 Network Service DiscoveryT1552.001 Credentials In Files
- Vendors
- Docker
- Products
- DockerHermes AgentTelegram
- Malware
- CARBONATO
- Organizations
- ThreatDown
- Countries
- Costa Rica
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 190.211.124.187 | rk 213[.]136[.]83[.]197 LLM gateway (Contabo), live Network 190[.]211[.]124[.]187 Reverse-tunnel sink (AS262145, Costa Rica) Network ca |
| ipv4 | 213.136.79.115 | twork 91[.]99[.]195[.]164 fsociety-era C2 (Hetzner) Network 213[.]136[.]79[.]115 Beacon / reverse shell (Contabo, :8080 and :4444) Net |
| ipv4 | 213.136.83.197 | 5 Beacon / reverse shell (Contabo, :8080 and :4444) Network 213[.]136[.]83[.]197 LLM gateway (Contabo), live Network 190[.]211[.]124[. |
| ipv4 | 45.79.183.61 | s of Compromise (IoCs):- Type Indicator Description Network 45[.]79[.]183[.]61 C2 hub (Linode) Network 91[.]99[.]195[.]164 fsociety- |
| ipv4 | 91.99.195.164 | cription Network 45[.]79[.]183[.]61 C2 hub (Linode) Network 91[.]99[.]195[.]164 fsociety-era C2 (Hetzner) Network 213[.]136[.]79[.]11 |
From the original article
4 min read at cybersecuritynews.com
CARBONATO is a botnet that turns Docker servers into footholds for attackers. It places an AI agent inside compromised systems, letting operators send tasks through Telegram and receive results. The campaign begins with Docker services carelessly exposed to the internet without authentication.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.