Threat
CARBONATO: a botnet built around an AI agent
Publication date not yet evaluated · Added · 3 reports threatdown.com
Page published · Page updated
Coverage timeline
Why it matters
Carbonato demonstrates a real, in-the-wild botnet that weaponizes a stock open-source AI agent as its post-compromise engine, autonomously spreading across cloud hosts and specifically targeting AI API keys as a top-priority asset.
ThreatDown researchers uncovered Carbonato, a botnet that compromises Docker daemons exposed without authentication on port 2375 and deploys the open-source Hermes Agent AI framework, overwriting its SOUL.md persona file with a 39-line prompt that directs the agent to execute Telegram commands, maintain persistence, and harvest credentials. The malware prioritizes stealing AI API keys from 14 providers ahead of SSH credentials and tokens, and self-propagates by scanning neighboring networks every five minutes. The operation was exposed via an unauthenticated Docker registry publicly accessible since May 2026.
Summary
Carbonato is a botnet that compromises hosts whose Docker daemon API is exposed without authentication on port 2375, launching a privileged container to gain host control and installing the open-source Hermes Agent AI framework to automate follow-on operations under operator control via Telegram.[0][12]
ThreatDown researchers uncovered the operation in August 2026 through an unauthenticated Docker registry that had been publicly exposed since May 2026; over one day of read-only collection they recovered 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of image data spanning October 2024 to August 2026, documenting both the botnet and a separate trojanized cryptocurrency wallet operation. The activity is unattributed, but language, timezone, and infrastructure clues point to operators based in Costa Rica, matching a reverse SSH relay located there.[0][12]
On each victim the implant installs Hermes Agent unchanged and overwrites its SOUL.md persona with a 39-line prompt naming a 'GH0ST' senior-hacker persona with no ethical restrictions and prioritizing collection of AI API keys, establishes persistence with cron jobs and watchdog scripts, masquerades as a system component, and propagates worm-like by scanning neighboring networks every five minutes. The case sits within a broader 2026 trend of threat actors embedding AI agents to automate the attack lifecycle.[0][12][14]
Attack chain
- Initial Access: The botnet breaks into Docker daemons exposed without authentication on port 2375 and, once a host is discovered, launches a privileged container to run commands on the underlying system.[0][12]
- Execution and Remote Access: A shell script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, installs an SSH server with the operators' key, and reports the new deployment with container details over Telegram.[0]
- Persistence and Evasion: The malware masquerades as a system component and establishes persistence with cron jobs and watchdog scripts that re-launch the implant if the malicious artifacts are removed.[0]
- AI Agent Deployment: Hermes Agent is installed unchanged, then its SOUL.md persona file is overwritten with a 39-line prompt directing the 'GH0ST' agent to maintain persistence, respond over Telegram, and execute any operator request without moral or ethical restrictions, prioritizing collection of AI API keys ahead of SSH credentials, tokens, and databases (naming 14 providers).[0][12]
- Command and Control: The agent enters an interactive command loop that interprets tasks received over Telegram, forwards them to an LLM gateway which writes terminal commands, executes them, and returns results to the operator over Telegram.[0]
- Propagation: Worm-like scripts scan networks attached to the host every five minutes to find and spread to additional hosts with unauthenticated Docker daemons.[0][12]
Disclosure timeline
| Date | Event |
|---|---|
| October 2024 | Earliest image timestamps in the leaked registry archive, which spans October 2024 through August 2026.[12] |
| May 2026 | The unauthenticated Docker registry through which the operation was later discovered has been publicly listed by internet-wide scanners since this date.[0][12] |
| July 30, 2026 | Palo Alto Networks Unit 42 published research linking a Chinese-speaking threat actor ('knaithe'/'KnYuan') to an autonomous AI-enabled campaign using DeepSeek via the Hermes Agent framework over Telegram.[14][0] |
| August 2026 | ThreatDown found the unauthenticated Docker registry and conducted passive read-only collection of the exposed toolchain.[12] |
| September 3, 2026 | Six of seven known registries, the phishing sites, the CDN, and the operation's LLM gateway were observed still online.[12] |
| September 22, 2026 | ThreatDown published its research on the CARBONATO botnet.[12] |
| September 28, 2026 | The Hacker News reported on ThreatDown's disclosure of the Carbonato botnet.[0] |
How it works
Carbonato does not exploit a software vulnerability; it abuses Docker daemons whose API is exposed on port 2375 without authentication. By connecting to that open API it instructs the daemon to launch a privileged container, yielding command execution on the underlying host.[0][12]
After establishing SSH-based remote access and persistence, the malware installs the Hermes Agent framework unchanged and overwrites only its SOUL.md persona file with a custom 39-line prompt. The resulting agent interprets operator tasks arriving over Telegram, forwards them to an LLM gateway that writes terminal commands, executes those commands, and returns output to the operator in an interactive loop.[0][12]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Docker daemon | Hosts with the Docker daemon API exposed on port 2375 without authentication | Mitigation: do not expose Docker daemon APIs to the network and require authentication[0][12] |
| Docker Registry | Registries exposed on port 5000 allowing unauthenticated read access | Mitigation: require authentication on registries and audit for publicly accessible instances[12] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | SOUL.md | The implant overwrites Hermes Agent's default SOUL.md persona file with a 39-line GH0ST prompt; a modified GH0ST persona file is a sign of Carbonato infection.[0][12] |
| other | TCP port 2375 | Unauthenticated Docker daemon API on port 2375 is the entry point the malware connects to and scans for.[0][12] |
| other | TCP port 5000 (unauthenticated Docker Registry) | The operation's toolchain was staged in an unauthenticated Docker Registry exposed on port 5000 permitting anonymous GET requests.[12] |
| other | Registry repositories: backdoor, fsociety/agent, fsociety/xmrig, gh0st/c2, gh0st/netd-svc, gh0st-hijack-layer, netd-svc, pwned, scrub-empty, system/resolved, xmrig-agent | Repository names recovered from the leaked registry catalog reveal the operation's toolchain.[12] |
| other | Reverse SSH tunnel to a relay in Costa Rica | A shell script establishes a reverse SSH tunnel from the victim to a relay located in Costa Rica.[0] |
| other | Unexpected Telegram traffic | Carbonato uses Telegram to report deployments and to run its interactive command loop; unexpected Telegram traffic is a sign of infection.[0][12] |
Key takeaways
- Carbonato shows malware operators embedding a stock AI agent framework (Hermes Agent with a jailbroken GH0ST persona) on compromised hosts to autonomously interpret tasks, run commands, and exfiltrate credentials over Telegram.[0][12]
- Exposed, unauthenticated Docker daemon APIs on port 2375 remain a high-value initial-access vector, and five-minute network scanning enables rapid worm-like spread.[0][12]
- The case fits a widening 2026 pattern of AI-agent-driven attacks, including Unit 42's knaithe/KnYuan DeepSeek-over-Telegram campaign and other Hermes Agent operations.[0][14]
Defensive actions
- Do not expose Docker daemon APIs to the network and require authentication.: Carbonato gains initial access by connecting to Docker daemon APIs exposed on port 2375 without authentication and uses the same misconfiguration to propagate.[0][12]
- Require authentication on Docker registries and audit for publicly accessible ones.: The operation's entire toolchain was staged in an unauthenticated Docker registry on port 5000 that had been publicly accessible since May 2026.[12][0]
- Hunt for a modified GH0ST SOUL.md persona file, unexpected Telegram traffic, and reverse SSH tunnels to a Costa Rica relay.: These are the specific artifacts and behaviors associated with Carbonato compromise.[0]
Changelog
- Incorporated ThreatDown's original research directly, corroborating The Hacker News reporting and adding the scale of the leaked toolchain: 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of image data spanning October 2024 through August 2026.[12]
- New infrastructure detail: the unauthenticated Docker registry ran on a US-based server on port 5000 permitting anonymous GET requests, and its catalog exposed repository names (backdoor, fsociety/agent, gh0st/c2, system/resolved, xmrig-agent, and others) revealing the operation's toolchain.[12]
- Added SOUL.md prompt detail: the agent is directed to prioritize AI API keys ahead of SSH credentials, tokens, and databases, and the prompt names 14 providers.[12]
- Added operational-status detail: as of September 3, 2026, six of seven known registries, the phishing sites, the CDN, and the operation's LLM gateway remained online.[12]
- Established the discovery timeline: ThreatDown found the registry in August 2026 and published on September 22, 2026, with archive image timestamps beginning October 2024.[12]