Carbonato botnet: AI-agent-driven worm hijacks unauthenticated Docker daemons on port 2375 and installs the Hermes Agent 'GH0ST' implant

Carbonato botnet (TL-2026-2639), also tracked as Carbonato, is a high-severity malware campaign, first published 2026-09-24. It is attributed to Carbonato operator with low confidence, affects Docker Docker Engine daemon (dockerd) Engine API, maps to 16 MITRE ATT&CK / ATLAS techniques (AML.T0053, T1021.004, T1036.005), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-2639

Threat ID
TL-2026-2639
Also known as
Carbonato, GH0ST, fsociety, netd-svc
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-24
Last reviewed
2026-09-24
Attribution
Carbonato operator
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cloud infrastructure, information technology, technology, hosting providers, software development, cryptocurrency, artificial intelligence
Target regions
Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in Carbonato botnet

Malware and tooling: Carbonato, FSociety, GH0ST, xmrig, Hermes Agent (Nous Research), gh0st

Carbonato is a worm-like botnet that compromises Linux hosts running Docker daemons whose Engine API is exposed without authentication on TCP/2375. It uses the exposed API to launch a privileged container with the host filesystem bind-mounted and host PID/network namespaces, escapes to the host via nsenter, opens a reverse SSH tunnel to a Costa Rica relay (AS262145), installs persistence across cron, systemd timers, rc.local and OpenRC, and installs the open-source Hermes Agent framework reconfigured through an overwritten SOUL.md persona file that renames the agent 'GH0ST' and makes it execute operator tasks delivered over Telegram. It self-propagates by sweeping every attached network and Docker bridge for other exposed daemons on port 2375 every five minutes.

How Carbonato botnet works

OVERVIEW. Carbonato is a Linux botnet that requires no software vulnerability to infect a host: its only prerequisite is a Docker daemon whose Engine API is reachable without authentication, most commonly because it has been bound to TCP port 2375 with no TLS and no auth plugin. ThreatDown (Malwarebytes) documented the campaign from an unauthenticated Docker registry the operators left exposed on port 5000 of a US-based server, recovering 59 repositories, 234 image tags, 605 SHA-256-verified blobs, 4.3 GB of image data and roughly 945,000 indexed files in one day of passive, read-only collection. Artifact timestamps in that archive span October 2024 to August 2026 and cover two linked product lines: a factory distributing trojanized cryptocurrency wallet applications and the Docker botnet itself. The exposed image configuration JSON leaked environment variables, entrypoints and full build history, which is how researchers recovered C2 addresses, Telegram bot tokens and the LLM gateway password.

INITIAL ACCESS AND CONTAINER ESCAPE. The implant searches for Docker daemons that accept unauthenticated connections, then drives the daemon through its own HTTP API to create a privileged container named netns-probe from alpine:latest with Privileged=true, Binds=[/:/host], PidMode=host and NetworkMode=host, and starts it via POST /containers/<id>/start. Command execution on the host is then achieved with the Docker exec API running nsenter -t 1 -m -u -n -i sh -c id, which enters the host's mount, UTS, network and IPC namespaces from inside the container. Because the host root filesystem is already bind-mounted at /host and the container shares the host PID and network namespaces, this is a straight container escape to full host control with no kernel exploit required. Thousands of hosts with reachable unauthenticated daemons make this a viable mass-infection primitive rather than a targeted technique.

HOST HOLDING, PERSISTENCE AND MASQUERADING. The implant kit entry.sh (observed at v5.3) opens a reverse SSH tunnel to a relay in Costa Rica, with the remote port derived deterministically from the MD5 hash of the victim's own IP address. It installs an SSH server on the victim and adds the operators' key, then sends a Telegram deployment report containing the container ID, hostname, IP address and country, written in voseo Spanish. Persistence is established through cron jobs, systemd timers, rc.local and OpenRC hooks, after which the files are marked immutable. Paired watchdog scripts (auto-persist-host.sh) monitor the deployment and re-pull the implant from the operators' registry if files or the container disappear. The deployment is disguised as a legitimate system component: the container is named systemd-resolved and serves a fake systemd-networkd resolver v2.0 banner, process arguments imitate the kernel worker thread form [kworker/u2:0], and a miner is planted at /usr/sbin/systemd-logind to look like a system service.

THE AI AGENT IMPLANT. The campaign's distinguishing feature is that its command-and-control loop is an LLM agent. Hermes Agent, an MIT-licensed open-source agent framework from Nous Research, is installed on the compromised host unmodified. The implant entrypoint then overwrites its SOUL.md persona file with a 39-line prompt that names the agent GH0ST and instructs it to maintain persistence and obey instructions received over Telegram. Operators send tasks into a Telegram chat (chat 750752697, which also receives the deployment reports); the model interprets the task, writes terminal commands, reads the output and decides what to do next, returning its report to the same chat. Documented loot priorities rank AI API keys above SSH credentials, access tokens and databases, with named providers including OpenAI, Anthropic, Google/Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM and One API; loot rules require every key, password and token to be stored in plaintext under /root/.hermes/loot/. The operators also ran an LLM gateway on a free tier that advertised 12 models while serving 27 through its API, fronted by proxies at carbonato-proxy-{drab,zeta,zeta-2}.vercel.app.

WORM PROPAGATION. Every five minutes the implant enumerates the host's attached networks and Docker bridges, sweeps each /24 on port 2375, verifies that the responding service is Docker, skips hosts it has already infected, and then repeats the full deployment against the new victim through a container named net-setup that pulls the system/resolved image. The AI agent plays no role in this phase: propagation is deterministic scripting, which is what makes the botnet grow without operator involvement.

INFRASTRUCTURE AND ATTRIBUTION. Recovered infrastructure spans several hosting providers: a C2 hub at 45.79.183.61 (Linode), an earlier 'fsociety'-era C2 at 91.99.195.164 (Hetzner), a beacon and reverse-shell host at 213.136.79.115 (Contabo, ports 8080 and 4444), a live LLM gateway at 213.136.83.197 (Contabo), and the reverse-tunnel sink at 190.211.124.187 in AS262145 (Costa Rica). The registry fleet ran across seven endpoints in AS40065, six of which were still online on 3 September 2026. ThreatDown could not link Carbonato to any known threat cluster; the attribution assessment to a Costa Rica-based operator rests on three converging indicators - reports written in voseo Spanish, the Telegram handle Carbo506 (+506 being Costa Rica's calling code), and the fact that 14 of 162 image configurations carry the UTC-06:00 America/Costa_Rica timezone - together with the AS262145 tunnel sink. A BeaconBeagle query against the published C2 IPs on 24 September 2026 returned no beacon or C2 configuration records, so the network infrastructure is not currently correlated with known C2 frameworks in that dataset.

DETECTION AND DEFENSIVE VALUE. Because no exploit or malware binary has to reach the host, prevention is configuration: the Docker daemon must never be exposed on a routable interface without TLS and client authentication, and registries must require authentication. On the host, the highest-fidelity indicators are a /root/.hermes/SOUL.md containing the GH0ST agent name, a .env carrying CARBONATO_API_KEY, unexplained Telegram egress, reverse SSH tunnels terminating in AS262145 on ports derived from the MD5 of the host's own IP, the watchdog at /usr/local/bin/.docker-network-monitor, processes with [kworker/...] style arguments, a miner masquerading as /usr/sbin/systemd-logind, and immutable bits set on files that should not be locked.

MITRE ATT&CK / ATLAS techniques used in TL-2026-2639

Execution

AML.T0053 AI Agent Tool Invocation; T1059.004 Unix Shell; T1610 Deploy Container

Lateral Movement

T1021.004 SSH

Stealth

T1036.005 Match Legitimate Resource Name or Location

Persistence

T1037.004 RC Scripts; T1053.003 Cron; T1053.006 Systemd Timers

Discovery

T1046 Network Service Discovery

Command and Control

T1102.002 Bidirectional Communication; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Defense Impairment

T1222.002 Linux and Mac Permissions

Impact

T1496 Resource Hijacking

Credential Access

T1552.001 Credentials In Files

Privilege Escalation

T1611 Escape to Host

Affected products and versions in Carbonato botnet

  • Docker — Docker Engine daemon (dockerd) Engine API
    Vulnerable versions: Any Docker daemon reachable over the network without authentication, most commonly bound with -H tcp://0.0.0.0:2375 (no TLS, no auth plugin); the campaign drives the daemon's own HTTP API to create and start privileged containers
    Fixed in: Not a software defect - remediated by configuration: bind the daemon to the local unix socket, or expose it only over TCP/2376 with TLS and client certificate authentication and an authorization plugin
  • Nous Research — Hermes Agent (open-source, MIT-licensed AI agent framework)
    Vulnerable versions: Installed unchanged from upstream on the compromised host and repurposed by overwriting its SOUL.md persona file with a 39-line prompt naming the agent 'GH0ST'; the framework is abused, not defective
  • Carbonato operators — Container images distributed from the operators' registry (port 5000)
    Vulnerable versions: Malicious images including netns-probe, net-setup, system/resolved, gh0st/c2, gh0st/netd-svc, gh0st-hijack-layer, fsociety/agent, fsociety/xmrig, netd-svc, xmrig-agent, backdoor, pwned and scrub-empty

Remediation for Carbonato botnet

Patches

  • No software patch applies: Carbonato exploits a deployment misconfiguration (an unauthenticated Docker Engine API on TCP/2375), not a software vulnerability, and no CVE is associated with the campaign
  • Apply the configuration fix instead - keep the Docker Engine API off the network or require TLS plus client authentication (CWE-306, Missing Authentication for Critical Function)

Immediate actions

  • Never expose the Docker daemon on TCP: remove any -H tcp://0.0.0.0:2375 or -H tcp://<routable-ip>:2375 listener, and bind the daemon to the local unix socket only (/var/run/docker.sock)
  • Firewall or security-group block TCP/2375 (and 2376 without mutual TLS) inbound from the internet and from untrusted internal segments; audit cloud security groups, NAT port-forwards and load balancers for published Docker API ports
  • Require authentication on every container registry: remove anonymous pull/push and stop running registries with the port-5000 HTTP API open to the internet
  • Hunt hosts for /root/.hermes/SOUL.md containing 'GH0ST', a .env carrying CARBONATO_API_KEY, the watchdog path /usr/local/bin/.docker-network-monitor, and process arguments of the form [kworker/u2:0]
  • Egress-block or alert on unexpected Telegram Bot API traffic (api.telegram.org) from server workloads, and on outbound SSH to AS262145 (Costa Rica)
  • Check for immutable files (lsattr) on cron, systemd, rc.local and OpenRC paths and for a reverse SSH tunnel whose remote port equals the MD5 of the host's own IP address
  • Block the published C2 and relay addresses at the perimeter: 45.79.183.61, 91.99.195.164, 213.136.79.115, 213.136.83.197, 190.211.124.187, and the carbonato-proxy-*.vercel.app proxies

Workarounds

  • Where remote Docker access is unavoidable, put the daemon behind an authenticating proxy or an SSH tunnel rather than exposing the API directly
  • Run workloads as non-root with a read-only root filesystem and drop privileged capability so that a compromised container cannot bind-mount the host root or enter host namespaces
  • Enable seccomp/AppArmor confinement and deny nsenter-style namespace entry from containers
  • Require authentication on registries and pull only from trusted registries to prevent the implant being re-fetched from operator-controlled infrastructure

Longer-term hardening

  • Adopt a hardened Docker daemon baseline as policy: unix-socket binding, TLS with client certificate authentication if remote access is genuinely required, and an authorization plugin
  • Continuously inventory and monitor internet-facing container infrastructure and registries for accidental exposure, treating a reachable daemon or registry API as a P1 finding
  • Alert on privileged container creation with host bind mounts, PidMode=host, NetworkMode=host or nsenter usage - these are the escape primitives this campaign depends on
  • Restrict AI-agent framework installation on production servers and treat the presence of an agent framework plus outbound LLM API traffic as a host-compromise indicator
  • Rotate every credential reachable from a compromised host - cloud keys, SSH keys, access tokens and especially AI provider API keys, which this campaign prioritises above all other loot
  • Monitor file immutability attribute changes and unexpected new cron, systemd timer, rc.local and OpenRC entries as a persistence-detection layer

Weaknesses (CWE) in Carbonato botnet

CWE-306

Timeline of Carbonato botnet

  • Earliest timestamps in the operators' leaked image archive date to October 2024, when the 'fsociety' tooling (fsociety/agent, fsociety/xmrig, gh0st/c2, backdoor, pwned) was being pushed alongside a separate campaign distributing trojanized cryptocurrency wallet applications.
  • The operators' unauthenticated Docker registry on port 5000 (US-based host, part of an AS40065 fleet of seven endpoints) begins appearing in internet-wide scanner listings and remains publicly reachable through the collection window.
  • Paired watchdog scripts (auto-persist-host.sh) and immutable cron, systemd timer, rc.local and OpenRC hooks are observed in the archive, re-pulling the implant from the operators' registry whenever files or the container are removed.
  • The implant kit is observed at entry.sh v5.3: a privileged container launch, a reverse SSH tunnel to a Costa Rica relay whose remote port is derived from the MD5 hash of the victim's own IP, an installed SSH server carrying the operators' key, and a Telegram deployment report written in voseo Spanish.
  • Analysis of the exposed image configuration JSON reveals environment variables, entrypoints and full command history, yielding C2 addresses, Telegram bot tokens and the LLM gateway password; 14 of 162 image configurations carry the UTC-06:00 (America/Costa_Rica) timezone.
  • ThreatDown researchers identify the exposed registry and perform one day of passive, read-only collection: 59 repositories, 234 image tags, 605 SHA-256-verified blobs, 4.3 GB of image data and roughly 945,000 indexed files.
  • A status check finds six of the seven known registry endpoints still online, alongside associated phishing sites, a CDN and the LLM gateway at 213.136.83.197.
  • ThreatDown publishes 'CARBONATO: a botnet built around an AI agent', reporting that the campaign could not be linked to any known threat cluster and that the evidence points to a Costa Rica-based operator.
  • BleepingComputer covers the campaign and publishes defensive guidance: keep Docker daemon APIs off the network, require authentication on registries, and hunt for the GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic and reverse SSH tunnels toward AS262145.

Sources cited for Carbonato botnet

More in malware

Detection coverage for TL-2026-2639

As of 2026-09-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2639 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats