other

Carbonato

Botnet malware with worm-like spreading that compromises Docker hosts through unauthenticated daemon APIs and installs the Hermes Agent AI framework for remote control.

Known aliases

CARBONATO botnet

Relationships

No evidence-backed relationships are recorded.

Current clusters

security2 publishers

Carbonato malware installs an AI agent on Docker hosts left exposed on port 2375

Malwarebytes' ThreatDown found Carbonato, a worm that reaches Docker daemons open on port 2375 without authentication and installs the Hermes AI agent to run attacker commands. Operators drive it from a Telegram chat, and the recovered evidence spans October 2024 to August 2026.

Publishers:bleepingcomputer.comscworld.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+15
Incentives30
Confidence55

security1 publisher

CARBONATO botnet infects Docker hosts, prioritizing theft of AI provider API keys

CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.

Publishers:securityaffairs.com

Reality

Evidence55
Adoption: Insufficient
Hype gap+15
Incentives: Insufficient
Confidence50