# CARBONATO Botnet Exploits Exposed Docker Daemons to Deploy AI Agent Framework, Prioritizes AI API Key Theft

> CARBONATO is a self-propagating Docker-worm botnet, documented by ThreatDown, that compromises unauthenticated Docker Engine API endpoints on port 2375, installs the legitimate open-source Hermes Agent AI framework with an overwritten persona file, and uses Telegram as an interactive command channel. The agent, renamed "GH0ST," prioritizes stealing AI API keys from 14 providers over SSH credentials and databases, and evidence from an exposed container registry (language, timezone, ASN, and a Telegram handle referencing Costa Rica's country code) points to Costa Rica-based operators.

- **Published:** 2026-09-27T00:00:00Z
- **Last reviewed:** 2026-09-29T11:38:55.070Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2689
- **ID:** TL-2026-2689
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CARBONATO targets Docker Engine API instances that are reachable over the network without authentication on the default TCP port 2375. Once it locates an exposed daemon, the implant instructs it to launch a privileged container with the host filesystem mounted, giving the operators direct command execution on the underlying machine (Docker API abuse / container escape). From that foothold, a deployment script (`entry.sh`, observed at v5.3) installs the open-source, MIT-licensed Hermes Agent framework from Nous Research completely unmodified, then overwrites only its `SOUL.md` persona file with a 39-line prompt that renames the agent "GH0ST" and instructs it to follow operator tasking delivered over Telegram, establish persistence, and harvest credentials without restriction, hashing, or masking.

Operators issue tasks through a Telegram channel (chat ID 750752697); the agent forwards the objective and persona file to an operator-run LLM gateway, which interprets the goal, writes terminal commands, executes them, and reports results back through the same Telegram loop -- an interactive, LLM-mediated command-and-control cycle rather than a traditional static C2 protocol. The persona explicitly ranks AI API keys from 14 providers (OpenAI, Anthropic, Google/Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API) above SSH credentials and database access, and all stolen material is written in plaintext under `/root/.hermes/loot/` with descriptive filenames. ThreatDown assesses the stolen AI credentials are used to subsidize the operators' own LLM gateway, which was still live and advertising 12 models on a free tier as of September 3, 2026.

Every five minutes, a worm component enumerates attached networks and Docker bridges and scans each reachable /24 subnet for port 2375, checking for prior infection before redeploying the same implant chain -- allowing the botnet to expand without operator intervention. Persistence is layered: a reverse SSH tunnel is opened from the victim to a Costa Rica-hosted relay (with the local tunnel port deterministically derived from an MD5 hash of the victim's IP), an SSH server is installed with an operator-controlled key, and redundant autostart hooks are placed via cron, systemd timers, rc.local, and OpenRC, with the underlying files marked immutable to resist tampering. Evasion includes disguising the watchdog process as the kernel thread `[kworker/u2:0]`, naming the malicious container `systemd-resolved` with a fake banner, and disguising a bundled XMRig cryptominer as `systemd-logind`.

ThreatDown discovered the operation after finding one of the operators' own container registries exposed to the internet without authentication, yielding 4.3 GB of image data across 59 repositories, 234 tags, and 605 verified file blobs -- effectively the attackers' entire toolchain, spanning an archived operational window from October 2024 through at least August 2026. Attribution to Costa Rica rests on three independent, converging signals: Voseo Spanish-language strings (a dialect using "vos" rather than "tu", characteristic of Central/South American Spanish) in build artifacts; 14 of 162 recovered image configurations set to the UTC-06:00 America/Costa_Rica timezone; and a Telegram operator handle, "Carbo506," where 506 is Costa Rica's international calling code, together with reverse-tunnel traffic terminating at AS262145, a Costa Rica-registered network. ThreatDown was unable to attribute the campaign to any previously tracked threat cluster or group.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1583.006 Web Services
- T1190 Exploit Public-Facing Application
- T1609 Container Administration Command
- T1053.003 Cron
- T1053.006 Systemd Timers
- T1037.004 RC Scripts
- T1098.004 SSH Authorized Keys
- T1611 Escape to Host
- T1036.005 Match Legitimate Resource Name or Location
- T1222.002 Linux and Mac Permissions
- T1552.001 Credentials In Files
- T1046 Network Service Discovery
- T1570 Lateral Tool Transfer
- T1021.004 SSH
- T1005 Data from Local System
- T1102.002 Bidirectional Communication
- T1572 Protocol Tunneling
- T1496 Resource Hijacking
- T1610 Deploy Container
- T1059.004 Unix Shell
- T1543.002 Systemd Service
- T1036.004 Masquerade Task or Service

## Sources

- [CARBONATO: a botnet built around an AI agent](https://www.threatdown.com/blog/carbonato/)
- [In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure](https://www.securityweek.com/in-other-news-clop-leak-site-takeover-docker-botnet-hunts-ai-keys-water-utility-exposure/)
- [New Carbonato malware uses AI agents to hijack exposed Docker hosts](https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/)
- [AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway](https://securityaffairs.com/199716/malware/ai-powered-carbonato-botnet-steals-credentials-to-fund-its-own-llm-gateway.html)
- [New Carbonato botnet uses AI framework to target insecure Docker daemons](https://www.scworld.com/brief/new-carbonato-botnet-uses-ai-framework-to-target-insecure-docker-daemons)
- [Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers](https://cybersecuritynews.com/botnet-uses-ai-agent/)
- [CARBONATO Botnet Uses AI Agent to Hijack Exposed Docker Hosts and Steal Cloud Credentials](https://cyberpress.org/carbonato-botnet-hijacks-docker-hosts/)
- [Hermes Agent -- Open-Source AI Agent That Grows With You](https://hermes-agent.nousresearch.com/)
- [NousResearch/hermes-agent](https://github.com/NousResearch/hermes-agent)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2689