Carbonato Malware Hijacks Exposed Docker Hosts With an AI Agent

A new botnet malware called Carbonato is targeting insecure Docker hosts and installing the Hermes Agent AI framework to give attackers interactive control of compromised systems.

The malware has worm-like capabilities and was discovered in an unauthorized Docker registry containing approximately 60 repositories and 4.3 GB of container image data.

ThreatDown researchers at cybersecurity company Malwarebytes obtained operational evidence covering October 2024 through August 2026. The archive also included information about the Carbonato botnet and a separate campaign that distributed counterfeit cryptocurrency wallet applications.

How Carbonato Infects Exposed Docker Hosts

According to Malwarebytes, Carbonato spreads by targeting Docker daemons whose APIs are exposed without authentication on port 2375.

After connecting to the Docker API, the malware instructs the daemon to launch a privileged container. This gives the attacker access to the underlying host and enables additional malware deployment.

Carbonato then opens a reverse SSH tunnel, installs an SSH server using the operator’s key, and sends reports about new deployments through Telegram. To maintain access, the malware also creates persistence mechanisms using:

• Cron jobs
• Systemd timers
• rc.local
• OpenRC hooks

Hermes AI Agent Gives Attackers Interactive Control

One of the most notable aspects of the campaign is the installation of Hermes Agent, an AI agent framework, on the compromised host. Carbonato instructs Hermes to override its default SOUL.md persona file with an agent named GH0ST.

Hermes has recently been used in malicious cyber operations. Cybersecurity firm Gambit previously documented a large-scale card-skimming operation involving the theft of 600,000 credit card records.

In the Carbonato campaign, Hermes processes commands sent through Telegram. The commands can instruct the agent to collect AI API keys, SSH credentials, access tokens, and other data; execute commands; and return the results to the operators.

Researchers describe the activity as an operator-driven “interactive command loop.”

“The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” ThreatDown researchers said.

“The agent executes these commands on the victim and sends the report back to the Telegram chat where it also receives deployment reports.”

Carbonato Uses Docker Hosts to Spread

Carbonato’s worm-like functionality allows it to search for other publicly accessible Docker daemons. A script scans the network connected to the compromised host every five minutes.

When the malware finds a new target, it retrieves the implant from the unauthorized registry, starts the same privileged container, and begins another persistence and scanning cycle.

Carbonato Indicators of Compromise

ThreatDown was unable to attribute Carbonato to a known threat cluster. However, researchers identified several pieces of evidence that point to Costa Rica as a possible location for the operator.

Organizations investigating potential infections should look for the following signs:

• A GH0ST persona file
• CARBONATO_API_KEY settings
• Unexpected Telegram traffic
• Reverse SSH tunnels to AS262145

How to Protect Exposed Docker Daemons

Researchers recommend disconnecting the Docker daemon API from the network and requiring authentication with the registry. These measures can help prevent attackers from connecting to an exposed Docker API and launching privileged containers.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Please reserve your seat