Carbonato: The Botnet That Weapons AI Agents Against Exposed Docker Hosts

On September 23, 2026, Malwarebytes ThreatDown researchers documented Carbonato, a malware campaign that exploits Docker daemons exposed on port 2375 without authentication to install an AI agent framework as a post-intrusion command tool. The analyzed evidence covers an operational window of nearly two years, from October 2024 to August 2026, and reveals an architecture that combines established persistence techniques with a significant innovation: the use of Hermes Agent, an open-source project from Nous Research, as an automated control interface via Telegram.

How the Infection Works: From Scan to Telegram Control

Initial entry occurs through Docker daemons exposed on port 2375. ThreatDown researchers documented precise API commands: a POST creates a container with HostConfig Privileged, Binds mounting the host filesystem to /host, PidMode host, and NetworkMode host. Subsequently, an exec with nsenter -t 1 allows command execution directly on the host system. The container masquerades as a system process: name "systemd-resolved", fake banner "systemd-networkd resolver v2.0", arguments mimicking [kworker/u2:0].

Once access is established, the entry.sh script overwrites Hermes Agent's original SOUL.md file with a 39-line malicious prompt. The resulting agent, dubbed "GH0ST," operates as the researchers describe: it interprets the task, writes terminal commands, reads the output, and decides the next action. Commands are received and reports returned via Telegram chat, as confirmed by C2 communication analysis.

Credential collection follows an explicit hierarchy: AI API keys from 14 named providers are the absolute priority, followed by SSH credentials, access tokens, and databases. This structure indicates a specific monetary intent tied to the market for generative AI service credentials.

The Infrastructure: Exposed Registry and Tunnel to Costa Rica

The archive discovered by ThreatDown offers rare visibility into active infrastructure. The unauthenticated Docker registry contained 59 repositories — including backdoor, fsociety/agent, gh0st/c2, gh0st/netd-svc, system/resolved — totaling 4.3 GB, 234 image tags, and 605 verified blob SHA-256 hashes. The registry was online from May 2026; as of September 3, 2026, 6 of 7 known registries, phishing sites, CDNs, and LLM gateways remained operational.

For remote control, Carbonato opens a reverse SSH tunnel to IP address 190.211.124.187, belonging to the Costa Rican cooperative Coopelesca R.L. under AS262145. The tunnel's remote port is derived from the MD5 hash of the victim's IP, ensuring deterministic reconnection. The use of voseo Spanish in Telegram deployment reports, a linguistic form associated with parts of Central and South America, supports the hypothesis of a geographic origin in the region, although no infrastructural overlap with known threat actors emerges at present.

"The model interprets the task, writes terminal commands, reads the output, and decides what to do next" — ThreatDown researchers, via BleepingComputer

Worm Propagation and Multi-Layered Persistence

Carbonato integrates automatic propagation capabilities: scripts configured to scan adjacent networks every 5 minutes for other exposed Docker daemons. Each new compromise pulls the implant and replicates the entire infection cycle. This mechanism, combined with the broad temporal window of activity, suggests a potentially extensive network of hosts, although the exact victim count is not documented.

Persistence is architected across multiple levels. The auto-persist-host.sh script creates hooks in cron, systemd, rc.local, and OpenRC, marks files as immutable, and deploys paired watchdogs that re-pull the implant from the registry in case of local removal. This technique makes cleanup significantly more complex than simply deleting the container: removing the visible artifact does not interrupt the reconstitution mechanism.

What to Do Now

• Verify that no Docker daemon exposes port 2375 on public interfaces without TLS authentication; Docker's default configuration does not require authentication on this port.
• Inspect for "systemd-resolved" or "[kworker/u2:0]" processes with anomalous network patterns, particularly outbound SSH connections to ASN AS262145 or addresses in the 190.211.124.0/24 network.
• Search filesystems for persistence indicators in cron, systemd timer, and rc.local paths, as well as files marked with the immutable attribute that should not be.
• Monitor for pull requests to public Docker registries with repository patterns similar to gh0st/c2, gh0st/netd-svc, system/resolved, or fsociety/agent.

Why AI Agent Usage Changes the Threat Model

The true element of discontinuity is not the compromise of exposed Docker hosts, a technique documented for years, but the choice to weaponize an open-source AI agent framework as a post-intrusion command interface. The attacker did not develop proprietary C2 infrastructure: they installed stock Hermes Agent, overwrote the configuration file, and delegated automation to an existing project. R&D costs for a sophisticated command system trend toward zero.

This approach prefigures an "AI-native" botnet model where artificial intelligence is not the target but the weapon: a human operator sets objectives, the agent autonomously generates commands, interprets output, and adapts actions. The current limit, not documented in the brief, concerns the actual degree of autonomy — whether the LLM processes locally or depends on external endpoints, and whether the loop is truly adaptive or a predefined sequence in disguise. What remains documented is the template: low-cost compromise, delegated post-intrusion automation, monetization via AI credential theft.

Frequently Asked Questions

Does Carbonato exploit a Docker zero-day vulnerability?
No. It exploits a misconfiguration: Docker API on port 2375 exposed without authentication. No CVE is associated.

Is the GH0ST agent an autonomous AI?
The evidence describes an "interactive command loop" in which the agent interprets tasks and generates commands, but does not document the actual degree of autonomy or the presence of human supervision in the loop. The term "AI agent" follows the Hermes project's definition, it does not imply autonomy without control.

Is the attacker confirmed to be operating from Costa Rica?
The SSH relay IP belongs to a Costa Rican cooperative and voseo Spanish indicates a Central-South American linguistic region. Researchers indicate the operator as "possibly based in Costa Rica." No infrastructural overlaps with known threat actors emerge.

Sources

• https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
• https://daily.dev/posts/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts-y3wkizgpx
• https://radar.offseq.com/threat/carbonato-a-botnet-built-around-an-ai-agent-c53c5f263470eaf2
• https://blog.netmanageit.com/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
• https://www.threatdown.com/blog/carbonato/
• https://support.threatdown.com/hc/en-us/
• https://support.threatdown.com/hc/en-us/p/oneview
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://www.bleepingcomputer.com/download/

Information verified against cited sources and current as of publication.

Sources