New Carbonato malware uses AI agents to hijack exposed Docker hosts
New Carbonato malware hijacks exposed Docker hosts using AI agents for control.
A new botnet malware named Carbonato is exploiting unsecured Docker hosts by leveraging the Hermes Agent AI framework to gain control. The malware spreads via worm-like capabilities, installs persistence mechanisms, and uses an AI agent named 'GH0ST' to interpret commands, execute them on victim systems, and report results through Telegram. Researchers identified operational evidence spanning October 2024 to August 2026 and suggest Costa Rica as a possible operator location.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Hermes Agent?
Get an email when a new story names Hermes Agent, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Carbonato malware campaign exploits Docker hosts left exposed to the internet without proper authentication or access controls, allowing attackers to gain full control over container environments. By leveraging an AI agent framework (Hermes/GH0ST), the malware autonomously interprets and executes commands, making it significantly more adaptive and harder to detect than traditional botnets. The use of Telegram as a command-and-control channel further obscures malicious traffic within legitimate services. This incident highlights the critical danger of exposing container orchestration infrastructure to the public internet without hardening, as a single misconfigured Docker API can become the entry point for a self-propagating worm affecting entire networks.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.