New Carbonato malware uses AI agents to hijack exposed Docker hosts
New Carbonato malware hijacks exposed Docker hosts using AI agents for control.
Summary
A new botnet malware named Carbonato is exploiting unsecured Docker hosts by leveraging the Hermes Agent AI framework to gain control. The malware spreads via worm-like capabilities, installs persistence mechanisms, and uses an AI agent named 'GH0ST' to interpret commands, execute them on victim systems, and report results through Telegram. Researchers identified operational evidence spanning October 2024 to August 2026 and suggest Costa Rica as a possible operator location.
Full text
New Carbonato malware uses AI agents to hijack exposed Docker hosts By Bill Toulas September 24, 2026 04:10 PM 0 A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. The malware features worm-like capabilities and was discovered in an unauthenticated Docker registry that contained nearly 60 repositories and 4.3 GB of image data. ThreatDown researchers at cybersecurity company Malwarebytes retrieved operational evidence spanning October 2024 to August 2026. The archive also included details about the botnet and a separate campaign that distributed counterfeit cryptocurrency wallet apps. According to Malwarebytes, Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication. The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host. It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram. At the same time, scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence. One notable aspect of the attack is that the AI agent framework Hermes Agent is installed on the hosts, using an agent named “GH0ST,” with instructions that overwrite the default ‘SOUL.md’ persona file. The GH0ST agent instructionsSource: ThreatDown Hermes has been extensively abused in malicious cyber-operations recently. Recently, cybersecurity company Gambit documented a large-scale card-skimming operation that stole 600.000 credit card details. In the case of Carbonato, Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back the results. The researchers describe this as an operator-driven process involving an “interactive command loop” exchange. “The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” ThreatDown researchers note. “The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports.” The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes. Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop. ThreatDown could not attribute Carbonato to any known threat clusters, but based on various evidence, points to Costa Rica as a possible location of the operator. To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries. Signs of Carbonato attacks include a GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: New ClosedQuorum Windows malware uses AI for attack decisionsNew RatHat Android malware uses AI to automate device controlSpain's data agency gets first report of AI-powered data breachAI-powered attack exploited PaperCut flaws to hack 395 organizationsHackers build AI frameworks for widescale credential theft