Carbonato malware turns AI agents loose on exposed Docker hosts

Researchers at Malwarebytes' ThreatDown have detailed a new piece of malware called Carbonato — a botnet with worm-like capabilities that seizes insecure hosts running a Docker daemon and installs the Hermes Agent AI framework on them.

The malware was found in an unauthenticated Docker registry holding nearly 60 repositories and 4.3 GB of image data. The archive contained operational evidence spanning October 2024 to August 2026, along with details about the botnet and a separate campaign that pushed counterfeit cryptocurrency wallet apps.

How infection works

Carbonato looks for Docker hosts whose API is exposed on port 2375 without authentication. After connecting, it instructs the daemon to launch a privileged container, gaining access to the host. It then opens a reverse SSH tunnel, installs an SSH server with the operators' key, and reports the new deployment via Telegram. For persistence it sets up cron jobs, systemd timers, rc.local, and OpenRC hooks.

The role of the AI agent

The striking part of the attack is that the Hermes Agent AI framework is installed on the hosts, using an agent named "GH0ST" whose instructions overwrite the default SOUL.md persona file. Hermes has been heavily abused in recent cyber-operations — the firm Gambit previously documented a large-scale card-skimming operation that stole 600,000 credit card records.

In Carbonato's case, Hermes handles commands received over Telegram: collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back results. Researchers describe this as an "interactive command loop": the model interprets the task, writes terminal commands, reads the output, and decides what to do next, then returns its report to the same Telegram chat.

The worm-like capability is handled by scripts that scan the host's attached networks every five minutes for fresh vulnerable Docker daemons. Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence-and-scanning loop.

Attribution and defense

ThreatDown could not tie Carbonato to any known threat clusters, but various evidence points to Costa Rica as a possible location for the operator. To prevent infection, researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries. Signs of compromise include a GH0ST persona file, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.

Source: Bleeping Computer