Carbonato malware uses AI agents to hijack Docker hosts

A newly discovered botnet called Carbonato is breaking into poorly secured Docker hosts and installing the Hermes Agent AI framework, which then carries out the operators' orders on compromised machines, according to ThreatDown.

The enterprise security company found the malware in an unauthenticated Docker registry that held nearly 60 repositories and 4.3 GB of image data. The operational evidence recovered from it covers the period from October 2024 to August 2026. The archive also held details on a separate campaign that pushed counterfeit cryptocurrency wallet apps, a lure that has recently shown up in Mac-focused stealer campaigns as well.

From an open port to a privileged container

Carbonato goes after Docker hosts whose API is exposed on port 2375 with no authentication. Docker is widely used to run applications in isolated containers, and its daemon is the background service that manages them.

Once the malware reaches the API, it tells the daemon to start a privileged container. This gives it access to the underlying host.

The next steps follow a set pattern. The malware:

• opens a reverse SSH tunnel
• installs an SSH server configured with the operators' key
• reports the new deployment to the attackers through Telegram

At the same time, scripts add persistence through cron jobs, systemd timers, rc.local and OpenRC hooks. These are different ways Linux systems run tasks at startup or on a schedule, so removing just one of them will not clean the host.

An AI agent called GH0ST

What sets Carbonato apart is its use of Hermes Agent. The attackers deploy an agent named "GH0ST" and replace the framework's default SOUL.md persona file with their own instructions.

Hermes has been used in several malicious operations recently. Cybersecurity company Gambit, for example, documented a large card-skimming operation built on it that stole 600,000 credit card details.

In Carbonato's case, the agent receives tasks through Telegram. These include collecting AI API keys, SSH credentials, access tokens and other data, running commands, and returning the results. ThreatDown describes this as an operator-driven process built around an "interactive command loop."

"The model interprets the task, writes terminal commands, reads the output, and decides what to do next," the researchers explained.

"The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports," they added.

Worm-like spreading

Carbonato does not wait for operators to find new targets. Scripts on each infected host scan attached networks every five minutes, looking for more exposed Docker daemons.

When they find one, the new victim pulls the implant from the registry, starts the same privileged container, and enters the same persistence and scanning loop.

ThreatDown could not link Carbonato to any known threat cluster. Based on several pieces of evidence, the researchers suggest the operator may be located in Costa Rica.

Detection and defence

To avoid infection, ThreatDown recommends keeping Docker daemon APIs off the network and requiring authentication on registries.

Indicators of a Carbonato compromise include:

• a GH0ST persona file
• the CARBONATO_API_KEY setting
• unexpected Telegram traffic
• reverse SSH tunnels toward AS262145, an autonomous system number that identifies a specific network on the internet

Our Take

The entry point here is old news. Docker APIs left open on port 2375 have been a known weakness for years, and the fix is simple. What is new is what happens after the break-in. Instead of shipping a fixed payload, the operators hand the host to an AI agent that decides for itself which commands to run and how to react to their output. This suggests attackers see agent frameworks as a flexible post-exploitation tool, one that can adapt to each machine without extra scripting.

The target list matters too. AI API keys sit next to SSH credentials and access tokens on the agent's shopping list. Stolen AI keys can be resold or used to run more agents at the victim's expense, and it is worth watching whether that becomes a common goal in cloud intrusions.

Carbonato also fits a wider pattern. AI agents are showing up on both sides of attacks, from flaws that let outsiders hijack Salesforce Agentforce to agents that breached a Medicare statistics portal in Australia. For defenders, the practical lesson is to treat unexpected agent frameworks and persona files on servers as red flags. Whether security tools start flagging such frameworks by default remains to be seen.