Security1 publisher2 min readPublished
Carbonato malware installs an AI agent on Docker hosts left exposed on port 2375
Malwarebytes' ThreatDown found Carbonato, a worm that reaches Docker daemons open on port 2375 without authentication and installs the Hermes AI agent to run attacker commands. Operators drive it from a Telegram chat, and the recovered evidence spans October 2024 to August 2026.
The Watch · Security desk
What happened
- Carbonato is a newly documented botnet that hijacks Docker hosts and installs the Hermes Agent AI framework to keep control of them.
- It reaches its targets through Docker daemon APIs left exposed on port 2375 without authentication.
- Once connected, it tells the daemon to launch a privileged container and gains access to the underlying host.
- Worm-like scripts rescan the networks attached to each host every five minutes to find the next exposed daemon.
- Malwarebytes' ThreatDown found the malware in an unauthenticated Docker registry holding nearly 60 repositories and 4.3 GB of image data.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Any Docker daemon reachable on port 2375 without authentication is a candidate for enrollment, and the worm hunts for the next one on its own.
- capability An operator drives the agent live and the model chooses each next command from the last output, so the on-host behavior varies per victim and does not match a fixed signature.
- precedent Hermes is turning up across separate criminal operations, so the GH0ST and SOUL.md agent pattern is likely to appear on other exposed services, not only Docker.
Once Hermes Agent is running on a host, it takes task commands from a Telegram chat and executes them live [10][11]. ThreatDown calls this an interactive command loop. "The model interprets the task, writes terminal commands, reads the output, and decides what to do next," the researchers said [12]. "The agent runs those commands on the victim and returns its report to the Telegram chat that also receives deployment reports" [13]. Through that loop it collects AI API keys, SSH credentials, and access tokens [10]. The operators run the agent as GH0ST and overwrite the framework's default SOUL.md persona file with their own instructions [9].
Before the agent runs, the compromise settles in. Carbonato opens a reverse SSH tunnel, installs an SSH server holding the operators' key, and reports each new box through Telegram [7]. Cron jobs, systemd timers, rc.local, and OpenRC hooks keep it resident [8]. Each fresh compromise then pulls the same implant from the registry and re-enters the privileged-container, persistence, and scanning loop [15].
Hermes is being reused beyond this operation. Gambit documented a card-skimming campaign built on the same framework that stole 600,000 credit card records [16].
The same archive held a separate campaign that pushed counterfeit cryptocurrency wallet apps [4]. ThreatDown could not tie the operation to a known threat cluster but points to Costa Rica as a possible location for the operator [17]. Signs on a host include a GH0ST persona file, a CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145 [19]. To close the vector, the researchers recommend keeping the Docker daemon API off the network and requiring authentication on registries [18].
What to watch
- Whether ThreatDown can move Costa Rica from a possible location to a firm attribution or link Carbonato to a named cluster.
- Whether the Hermes GH0ST and SOUL.md payload pattern shows up on exposed services beyond Docker.
- Whether the counterfeit crypto-wallet campaign found in the same registry is operated by the Carbonato crew.