New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
Malwarebytes ThreatDown researchers uncovered Carbonato, a worm-like botnet that compromises Docker hosts exposing an unauthenticated API on port 2375. The malware launches a privileged container, opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and persists via cron, systemd timers, rc.local, and OpenRC. It installs the Hermes Agent framework under a GH0ST persona that receives Telegram tasks to collect AI API keys, SSH credentials, and tokens, then runs commands and returns results. Implants came from an open registry of nearly 60 repositories and 4.3 GB of images, with activity from October 2024 to August 2026; attribution is unconfirmed, with Costa Rica a possible operator location.
- Carbonato targets Docker daemons exposing an unauthenticated API on port 2375.
- It launches a privileged container, reverse SSH tunnel, and operator SSH keys.
- Hermes Agent persona GH0ST runs Telegram tasks and steals credentials and tokens.
- Worm scripts scan attached networks every five minutes for more exposed hosts.
- No known cluster is attributed; Costa Rica is a possible operator location.
- ATT&CK
- T1610 Deploy ContainerT1572 Protocol TunnelingT1098.004 SSH Authorized KeysT1053.003 CronT1046 Network Service Discovery
- Vendors
- DockerMalwarebytes
- Products
- DockerHermes Agent
- Malware
- Carbonato
- Organizations
- MalwarebytesThreatDown
- Countries
- Costa Rica
From the original article
2 min read at bleepingcomputer.com
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.