Threat · curated 24 Sep 2026
New Carbonato malware uses AI agents to hijack exposed Docker hosts
First reported bleepingcomputer.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Carbonato demonstrates real-world weaponization of an autonomous AI agent framework to run an interactive command loop on compromised hosts and self-propagate, showing that agentic AI is now an operational component of in-the-wild botnet malware.
Carbonato is a new worm-like botnet malware that hijacks insecure Docker daemons exposed on port 2375 and installs the Hermes Agent AI framework (using an agent named 'GH0ST') to autonomously execute attacker tasks received via Telegram. Discovered by Malwarebytes/ThreatDown in an exposed Docker registry, the AI agent interprets tasks, writes and runs terminal commands, reads output, and collects AI API keys, SSH credentials, and tokens while spreading to other exposed hosts every five minutes.
Summary
Carbonato is a newly documented botnet malware that hijacks insecure hosts running Docker daemons with an unauthenticated API exposed on port 2375, launching a privileged container to gain host control and installing the Hermes Agent AI framework to automate follow-on actions.[1]
ThreatDown researchers at Malwarebytes discovered the malware in an unauthenticated Docker registry containing nearly 60 repositories and 4.3 GB of image data, with operational evidence spanning October 2024 to August 2026 and also covering a separate counterfeit cryptocurrency wallet campaign. Researchers could not attribute Carbonato to a known threat cluster but point to Costa Rica as a possible operator location.[1]
The malware establishes persistence through SSH keys, reverse SSH tunnels, cron jobs, systemd timers, rc.local, and OpenRC hooks, uses Telegram as its command channel, and propagates worm-like by scanning attached networks every five minutes for additional exposed Docker daemons.[1]
Attack chain
- Initial Access: The malware connects to a Docker daemon whose API is exposed on port 2375 without authentication.[1]
- Execution: It instructs the Docker daemon to launch a privileged container, granting access to the underlying host, and pulls the implant from the attacker's Docker registry.[1]
- Persistence: Scripts install an SSH server with the operators' key, open a reverse SSH tunnel, and set up cron jobs, systemd timers, rc.local, and OpenRC hooks.[1]
- AI Agent Deployment: The Hermes Agent AI framework is installed with an agent named GH0ST, overwriting the default SOUL.md persona file so the model interprets tasks, writes terminal commands, reads output, and decides next steps.[1]
- Command and Control: Deployments and task commands are handled through a Telegram chat, with the agent running commands on the victim and returning reports via an interactive command loop.[1]
- Collection: Through Telegram-received tasks, Hermes collects AI API keys, SSH credentials, access tokens, and other data, and returns results.[1]
- Propagation: Worm-like scripts scan networks attached to the host every five minutes; each new compromise pulls the implant from the registry, launches the same privileged container, and re-enters the persistence and scanning loop.[1]
Disclosure timeline
| Date | Event |
|---|---|
| October 2024 to August 2026 | Operational evidence for the Carbonato botnet, retrieved by ThreatDown, spans this period.[1] |
| September 24, 2026 | BleepingComputer reports on ThreatDown/Malwarebytes' documentation of the Carbonato malware.[1] |
How it works
Carbonato does not exploit a software vulnerability but abuses Docker daemons whose API is exposed on port 2375 without authentication. By connecting to that open API it instructs the daemon to launch a privileged container, which yields access to the host operating system.[1]
Once on the host, the malware installs the Hermes Agent AI framework configured with a GH0ST agent (its SOUL.md persona file overwritten). The model interprets operator tasks from Telegram, writes and executes terminal commands, reads the output, and autonomously decides subsequent actions in an interactive command loop.[1]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Docker daemon | Hosts with the Docker daemon API exposed on port 2375 without authentication | Mitigation: keep Docker daemon APIs off the network and require authentication on registries[1] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | SOUL.md | The GH0ST agent installation overwrites the default Hermes SOUL.md persona file; presence of a GH0ST persona file is a sign of Carbonato infection.[1] |
| other | CARBONATO_API_KEY | Configuration setting present on infected hosts, flagged by researchers as a sign of Carbonato attacks.[1] |
| other | AS262145 | Reverse SSH tunnels toward autonomous system AS262145 are an indicator of Carbonato compromise.[1] |
| other | TCP port 2375 | Unauthenticated Docker daemon API exposed on port 2375 is the entry point the malware connects to.[1] |
| other | Unexpected Telegram traffic | Carbonato uses Telegram for deployment reports and its command loop; unexpected Telegram traffic is a listed sign of infection.[1] |
Key takeaways
- Carbonato demonstrates malware operators embedding an AI agent framework (Hermes/GH0ST) on compromised hosts to autonomously interpret tasks, run commands, and exfiltrate credentials via Telegram.[1]
- Exposed, unauthenticated Docker daemon APIs on port 2375 remain a high-value initial-access vector, and worm-like network scanning every five minutes enables rapid lateral spread.[1]
Defensive actions
- Keep Docker daemon APIs off the network.: Carbonato gains initial access by connecting to Docker daemon APIs exposed on port 2375 without authentication.[1]
- Require authentication on Docker registries.: The malware was found in an unauthenticated Docker registry, and new compromises pull the implant from a registry.[1]
- Hunt for GH0ST persona files, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.: These are the specific signs of Carbonato attacks identified by the researchers.[1]