Security1 publisher2 min readPublished
CARBONATO botnet infects Docker hosts, prioritizing theft of AI provider API keys
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
The Watch · Security desk
What happened
- CARBONATO scans the internet for Docker daemons that accept unauthenticated connections on port 2375, a configuration thousands of hosts still leave publicly reachable.
- ThreatDown discovered the botnet, active since at least October 2024, after its operators left a container registry exposed, and pulled 4.3 GB of images in a day: 59 repositories, 234 tags, and 605 verified file blobs.
- The implant installs Nous Research's MIT-licensed Hermes Agent without modifying the code, driving the framework entirely through a swapped configuration file.
- GH0ST's overriding instruction is to steal API keys, which it ranks above SSH credentials, access tokens, and databases.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability The exposed registry handed ThreatDown the crew's command-and-control addresses, bot tokens, and the shared AI gateway password, so blocklists and a takedown can be built from the operators' own files.
- cost Every stolen provider key turns a victim's AI account into a payer for the operators' inference, monetising a compromised host beyond the usual crypto mining or proxy resale.
- constraint There is no vulnerability to patch here, so defenders cannot wait for a fix; the only lever is whether the Docker daemon is reachable without authentication.
- precedent Treating AI provider keys as the top prize signals where the money now sits for opportunistic crews, and more implants are likely to hunt provider keys first.
There is no exploit in the entry step. A Docker daemon listening for unauthenticated connections on port 2375 exposes the same API an administrator uses, and CARBONATO uses it to start a privileged container with the host filesystem mounted, then runs its commands on the underlying machine through that container [7].
What lands next is built to survive a cleanup. "The container starts by running entry.sh. The script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, giving the operators a path back into the host. Its remote port is derived from the MD5 hash of the victim's IP address, so the crew can calculate the same port whenever it needs to reconnect," ThreatDown wrote [8]. The same script "installs an SSH server, adds the crew's key, and sends a deployment report to Telegram with the container ID, hostname, IP address, and country" [9].
Persistence is written into cron jobs, systemd timers, rc.local, and OpenRC, and each of those files is then marked immutable so an administrator cannot simply delete it [11]. A watchdog re-pulls the implant from the registry if the container disappears [12]. The container runs under the name "systemd-resolved" behind a fake resolver banner, and its process arguments imitate the kernel thread [kworker/u2:0], so a quick look at the process list shows nothing wrong [13].
Then comes the agent. "At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file," the report states [15]. The crew edits one file. A 39-line prompt renames the agent GH0ST [16] and, per the report, "directs it to execute tasks received through Telegram, maintain persistence, and collect credentials" [19]. Because the malice lives in the prompt and not the binary, scanning the file on disk finds an unmodified open-source framework [20].
The prompt sets a single priority above everything else. GH0ST is told to collect API keys for OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API [17]. The operators' own LLM gateway explains why: it was still answering on September 3, running on a free tier while advertising 12 models and serving 27 through its API [18]. Stolen keys pay for the inference.
Attribution points at Costa Rica without naming anyone. The reverse tunnels terminate at a relay there [8], and the deployment reports are written in voseo Spanish, the regional form that uses "vos" instead of "tu" [10]. ThreatDown says the infrastructure could be operated from somewhere else [5].
What to watch
- Whether the 14 named providers revoke and rotate keys tied to CARBONATO victims, and whether the operators' gateway password gets burned now that the registry is public.
- Whether the Costa Rica relay and the Telegram deployment channels are taken down after ThreatDown's disclosure.
- Whether other crews copy the prompt-swap technique against unmodified open-source agent frameworks to dodge binary scanning.