A botnet named CARBONATO is compromising poorly secured Docker infrastructure and installing an AI agent that can interpret operator requests, generate terminal commands and return results through Telegram. The operation combines conventional automated spreading with language-model-assisted activity inside each victim, creating a flexible platform for credential theft and follow-on attacks.

ThreatDown researchers uncovered the campaign after discovering an unauthenticated Docker registry that had reportedly been exposed since May 2026. In one day they recovered 59 repositories, 234 image tags, 605 verified blobs and 4.3 GB of material dating from October 2024 through August 2026. The archive provided an unusually detailed view of the botnet’s deployment, persistence and control mechanisms.

Exposed Docker APIs become host access

Initial access does not depend on a new software vulnerability. CARBONATO searches for Docker daemons that accept unauthenticated connections over the network. After finding one, it creates a privileged container with access to the victim’s filesystem, processes and network, then uses that position to execute commands on the underlying server.

An entry script establishes a reverse SSH tunnel, installs an SSH server and an attacker key, and sends deployment information to Telegram. The implant disguises containers and processes to resemble routine Linux activity. It creates several forms of persistence, including cron jobs, systemd timers, startup scripts and OpenRC entries, and uses watchdogs capable of restoring components from the registry if they disappear.

Every five minutes, scripts inspect the host’s connected networks and Docker bridges. They scan nearby /24 ranges for more exposed Docker services and repeat the deployment when a target responds. This worm-like propagation is performed by ordinary scripts, not the AI agent, so the botnet can continue spreading without waiting for model decisions or operator prompts.

An agent interprets attacker tasks

Inside compromised systems, CARBONATO deploys the open-source Hermes Agent framework without modifying its core software. The attackers instead replace its persona file with instructions to preserve access, collect secrets and follow tasks delivered through Telegram. An operator request is sent with those instructions to a language-model gateway. The model translates the goal into shell commands, evaluates the output and decides what to attempt next.

The agent prioritizes AI service API keys, followed by SSH credentials, access tokens and database secrets. This order reflects the growing value of model access in criminal ecosystems: stolen keys can finance further automation, expose proprietary conversations or provide access to connected tooling. Researchers found the gateway advertised 12 models while its interface exposed 27.

The use of a legitimate framework complicates simplistic detection. Blocking every copy of Hermes Agent would affect benign users, while the malicious behavior comes from its startup instructions and surrounding infrastructure. Defenders need behavioral signals such as an agent executing system-discovery commands, accessing credential locations or communicating through Telegram from a server.

Breaking the attack chain

The most important control is preventing unauthenticated access to Docker management interfaces and registries. These services should not be reachable from public networks, and internal access should be authenticated and restricted to specific administration systems.

• Inventory Docker API listeners and close unnecessary TCP exposure.
• Require authentication for registries and rotate credentials if image storage was exposed.
• Investigate unexpected privileged containers, host filesystem mounts and reverse SSH tunnels.
• Review cron, systemd, startup and OpenRC entries for unfamiliar persistence.
• Monitor server-originated Telegram traffic and inventory AI API keys on workloads.
• Segment container networks to prevent automatic scanning of adjacent address ranges.

Because the implant can reappear through watchdogs, deleting a suspicious container is not sufficient. Incident responders should isolate the host, preserve evidence, identify every persistence mechanism, rotate SSH and API credentials, and rebuild from trusted images where integrity cannot be established.

CARBONATO does not replace traditional botnet engineering with AI. It layers an adaptable command interpreter on top of proven techniques: exposed management services, privileged containers, reverse tunnels and redundant persistence. That combination lets automation handle predictable propagation while an operator uses the agent for tasks requiring context inside a newly compromised environment.

Source: Cyber Security News.