New Carbonato malware uses AI agents to hijack exposed Docker hosts

A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control.

The malware features worm-like capabilities and was discovered in an unauthenticated Docker registry that contained nearly 60 repositories and 4.3 GB of image data.

ThreatDown researchers at cybersecurity company Malwarebytes retrieved operational evidence spanning October 2024 to August 2026. The archive also included details about the botnet and a separate campaign that distributed counterfeit cryptocurrency wallet apps.

According to Malwarebytes, Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication.

The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host.

It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram. At the same time, scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.

One notable aspect of the attack is that the AI agent framework Hermes Agent is installed on the hosts, using an agent named “GH0ST,” with instructions that overwrite the default ‘SOUL.md’ persona file.

Hermes has been extensively abused in malicious cyber-operations recently. Recently, cybersecurity company Gambit documented a large-scale card-skimming operation that stole 600.000 credit card details.

In the case of Carbonato, Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back the results.

The researchers describe this as an operator-driven process involving an “interactive command loop” exchange.

“The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” ThreatDown researchers note.

“The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports.”

The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes.

Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop.

ThreatDown could not attribute Carbonato to any known threat clusters, but based on various evidence, points to Costa Rica as a possible location of the operator.

To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.

Signs of Carbonato attacks include a GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat