New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
Malwarebytes ThreatDown researchers uncovered Carbonato, a worm-like botnet that compromises Docker hosts exposing an unauthenticated API on port 2375. The malware launches a privileged container, opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and persists via cron, systemd timers, rc.local, and OpenRC. It installs the Hermes Agent framework under a GH0ST persona that receives Telegram tasks to collect AI API keys, SSH credentials, and tokens, then runs commands and returns results. Implants came from an open registry of nearly 60 repositories and 4.3 GB of images, with activity from October 2024 to August 2026; attribution is unconfirmed, with Costa Rica a possible operator location.
- Carbonato targets Docker daemons exposing an unauthenticated API on port 2375.
- It launches a privileged container, reverse SSH tunnel, and operator SSH keys.
- Hermes Agent persona GH0ST runs Telegram tasks and steals credentials and tokens.
- Worm scripts scan attached networks every five minutes for more exposed hosts.
- No known cluster is attributed; Costa Rica is a possible operator location.
Full article471 words · extracted from bleepingcomputer.com · click to collapse
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control.
The malware features worm-like capabilities and was discovered in an unauthenticated Docker registry that contained nearly 60 repositories and 4.3 GB of image data.
ThreatDown researchers at cybersecurity company Malwarebytes retrieved operational evidence spanning October 2024 to August 2026. The archive also included details about the botnet and a separate campaign that distributed counterfeit cryptocurrency wallet apps.
According to Malwarebytes, Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication.
The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host.
It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram. At the same time, scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.
One notable aspect of the attack is that the AI agent framework Hermes Agent is installed on the hosts, using an agent named “GH0ST,” with instructions that overwrite the default ‘SOUL.md’ persona file.
Source: ThreatDown
Hermes has been extensively abused in malicious cyber-operations recently. Recently, cybersecurity company Gambit documented a large-scale card-skimming operation that stole 600.000 credit card details.
In the case of Carbonato, Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back the results.
The researchers describe this as an operator-driven process involving an “interactive command loop” exchange.
“The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” ThreatDown researchers note.
“The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports.”
The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes.
Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop.
ThreatDown could not attribute Carbonato to any known threat clusters, but based on various evidence, points to Costa Rica as a possible location of the operator.
To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.
Signs of Carbonato attacks include a GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.