CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft
CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy (TL-2026-2689) is a high-severity malware campaign, first published 2026-09-27. It has no confirmed attribution, affects Docker Docker Engine API (dockerd), maps to 19 MITRE ATT&CK techniques (T1005, T1021.004, T1036.005), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-2689
- Threat ID
- TL-2026-2689
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-27
- Last reviewed
- 2026-09-27
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- financial services, cloud hosting infrastructure, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
Malware and tooling: CARBONATO, xmrig, Hermes Agent, auto-persist-host.sh, gh0st
CARBONATO is a self-propagating Docker-worm botnet, documented by ThreatDown, that compromises unauthenticated Docker Engine API endpoints on port 2375, installs the legitimate open-source Hermes Agent AI framework with an overwritten persona file, and uses Telegram as an interactive command channel. The agent, renamed "GH0ST," prioritizes stealing AI API keys from 14 providers over SSH credentials and databases, and evidence from an exposed container registry (language, timezone, ASN, and a Telegram handle referencing Costa Rica's country code) points to Costa Rica-based operators.
How CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy works
CARBONATO targets Docker Engine API instances that are reachable over the network without authentication on the default TCP port 2375. Once it locates an exposed daemon, the implant instructs it to launch a privileged container with the host filesystem mounted, giving the operators direct command execution on the underlying machine (Docker API abuse / container escape). From that foothold, a deployment script (`entry.sh`, observed at v5.3) installs the open-source, MIT-licensed Hermes Agent framework from Nous Research completely unmodified, then overwrites only its `SOUL.md` persona file with a 39-line prompt that renames the agent "GH0ST" and instructs it to follow operator tasking delivered over Telegram, establish persistence, and harvest credentials without restriction, hashing, or masking.
Operators issue tasks through a Telegram channel (chat ID 750752697); the agent forwards the objective and persona file to an operator-run LLM gateway, which interprets the goal, writes terminal commands, executes them, and reports results back through the same Telegram loop -- an interactive, LLM-mediated command-and-control cycle rather than a traditional static C2 protocol. The persona explicitly ranks AI API keys from 14 providers (OpenAI, Anthropic, Google/Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API) above SSH credentials and database access, and all stolen material is written in plaintext under `/root/.hermes/loot/` with descriptive filenames. ThreatDown assesses the stolen AI credentials are used to subsidize the operators' own LLM gateway, which was still live and advertising 12 models on a free tier as of September 3, 2026.
Every five minutes, a worm component enumerates attached networks and Docker bridges and scans each reachable /24 subnet for port 2375, checking for prior infection before redeploying the same implant chain -- allowing the botnet to expand without operator intervention. Persistence is layered: a reverse SSH tunnel is opened from the victim to a Costa Rica-hosted relay (with the local tunnel port deterministically derived from an MD5 hash of the victim's IP), an SSH server is installed with an operator-controlled key, and redundant autostart hooks are placed via cron, systemd timers, rc.local, and OpenRC, with the underlying files marked immutable to resist tampering. Evasion includes disguising the watchdog process as the kernel thread `[kworker/u2:0]`, naming the malicious container `systemd-resolved` with a fake banner, and disguising a bundled XMRig cryptominer as `systemd-logind`.
ThreatDown discovered the operation after finding one of the operators' own container registries exposed to the internet without authentication, yielding 4.3 GB of image data across 59 repositories, 234 tags, and 605 verified file blobs -- effectively the attackers' entire toolchain, spanning an archived operational window from October 2024 through at least August 2026. Attribution to Costa Rica rests on three independent, converging signals: Voseo Spanish-language strings (a dialect using "vos" rather than "tu", characteristic of Central/South American Spanish) in build artifacts; 14 of 162 recovered image configurations set to the UTC-06:00 America/Costa_Rica timezone; and a Telegram operator handle, "Carbo506," where 506 is Costa Rica's international calling code, together with reverse-tunnel traffic terminating at AS262145, a Costa Rica-registered network. ThreatDown was unable to attribute the campaign to any previously tracked threat cluster or group.
MITRE ATT&CK techniques used in TL-2026-2689
Collection
Lateral Movement
T1021.004 SSH; T1570 Lateral Tool Transfer
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location
Persistence
T1037.004 RC Scripts; T1053.003 Cron; T1053.006 Systemd Timers; T1098.004 SSH Authorized Keys
Discovery
T1046 Network Service Discovery
Command and Control
T1102.002 Bidirectional Communication; T1572 Protocol Tunneling
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
T1222.002 Linux and Mac Permissions
Impact
Credential Access
T1552.001 Credentials In Files
Resource Development
Reconnaissance
T1595.002 Vulnerability Scanning
Execution
T1609 Container Administration Command
Privilege Escalation
Affected products and versions in CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
- Docker — Docker Engine API (dockerd)
Vulnerable versions: any version reachable with the TCP API exposed on port 2375 without TLS client authentication
Fixed in: N/A -- misconfiguration; enable --tlsverify or restrict the API to a local Unix socket - Nous Research — Hermes Agent (open-source AI agent framework)
Vulnerable versions: framework is abused unmodified; risk is persona-file (SOUL.md) overwrite after host compromise, not a code vulnerability
Fixed in: N/A -- legitimate software; mitigation is preventing the initial Docker host compromise
Remediation for CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
Patches
- No vendor patch applies; unauthenticated Docker API exposure is a deployment misconfiguration, not a software vulnerability
Immediate actions
- Firewall or disable the Docker Engine API (TCP port 2375) from the internet and from untrusted internal networks immediately
- Rotate and revoke any AI/LLM API keys (OpenAI, Anthropic, Google/Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, One API) and SSH credentials that were reachable from an internet-exposed Docker host
- Hunt for /root/.hermes/SOUL.md containing the string 'GH0ST', .env files defining CARBONATO_API_KEY, unexpected outbound Telegram Bot API traffic, and reverse SSH tunnels terminating toward AS262145
- Inspect running containers for one named systemd-resolved with a mounted host filesystem, and processes masquerading as [kworker/u2:0] or systemd-logind
Workarounds
- Bind the Docker daemon to a Unix socket only (remove any -H tcp://0.0.0.0:2375 flag) and require an authenticated SSH tunnel or reverse proxy for any legitimate remote Docker API access
Longer-term hardening
- Require mutual TLS (dockerd --tlsverify with client certificates) or restrict the Docker Engine API to a local Unix socket; never bind it to 0.0.0.0 without authentication
- Deploy container/runtime security tooling that alerts on privileged container creation with host filesystem bind-mounts
- Store AI/LLM API keys and SSH credentials in a managed secrets store rather than plaintext .env files or filesystem loot directories, with periodic rotation
- Monitor for newly created cron jobs, systemd timers, rc.local edits, and OpenRC hooks with the immutable (chattr +i) flag set on hosts running container workloads
Weaknesses (CWE) in CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
CWE-306, CWE-284, CWE-522
Timeline of CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
- Earliest CARBONATO-related build artifacts recovered from the exposed container registry date to October 2024, marking the start of the archived operational window ThreatDown was able to reconstruct.
- Internet-wide scanning services first index the unauthenticated CARBONATO container registry, though it goes unnoticed by defenders for months.
- ThreatDown researchers discover the exposed, unauthenticated Docker registry, gaining visibility into the botnet's full toolchain: 59 repositories, 234 tags, and 605 verified file blobs totaling 4.3 GB.
- Six of the seven identified CARBONATO registries, plus associated phishing sites, a CDN, and the operators' free-tier LLM gateway (advertising 12 models), are confirmed still live.
- ThreatDown publishes 'CARBONATO: a botnet built around an AI agent,' detailing the Docker exploitation chain, the Hermes Agent/GH0ST payload, Telegram-based C2, the AI-API-key theft priority list, and the Costa Rica attribution signals.
- BleepingComputer and Security Affairs publish independent technical write-ups corroborating the privileged-container exploitation of Docker port 2375, the 14-provider AI API key priority list, and the Costa Rica attribution evidence.
- SecurityWeek, SC Media, CyberPress, and Cybersecurity News reference the CARBONATO findings in industry news coverage, surfacing the campaign for wider security-community awareness.
Sources cited for CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy
- CARBONATO: a botnet built around an AI agent
- In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
- New Carbonato malware uses AI agents to hijack exposed Docker hosts
- AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
- New Carbonato botnet uses AI framework to target insecure Docker daemons
- Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
- CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials
- Hermes Agent -- Open-Source AI Agent That Grows With You
- NousResearch/hermes-agent
More in malware
- ClickFix Campaign Abuses Compromised Ukrainian Websites to Deploy Psychedelic Stealer
- The Infostealer Incursion: Stolen Credentials Breach Cloud, Code, and AI Environments
- x47.c Windows Botnet-as-a-Service Weaponizes xAI Grok for AI-Assisted Persistence and AI API Credit Draining
- Sauron Loader: New DLL Side-Loading Malware-as-a-Service Deployed Against German Organizations via ClickFix, Email Bombing, and Remote-Access-Tool Vishing
- PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence
Detection coverage for TL-2026-2689
As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2689 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.