A Worm That Hands Compromised Docker Hosts to an AI Agent
ThreatDown, Malwarebytes' threat-intelligence unit, has identified a new botnet malware family called Carbonato that combines worm-like self-propagation through misconfigured Docker hosts with a novel twist: once a host is compromised, Carbonato installs the Hermes Agent AI framework and lets attackers issue tasking instructions to it over Telegram. Reported by BleepingComputer on September 24, 2026, the campaign was uncovered after ThreatDown researchers found an unauthenticated Docker registry exposing nearly 60 repositories and 4.3 GB of operational data, spanning activity from October 2024 through August 2026.
Details
| Attribute | Value |
|---|---|
| Malware Family | Carbonato (worm-capable Docker-targeting botnet) |
| Discovered By | ThreatDown researchers (Malwarebytes) |
| Initial Access | Unauthenticated Docker Engine API, typically exposed on TCP port 2375 |
| AI Component | Hermes Agent, deployed with a custom "GH0ST" persona |
| C2 Channel | Telegram |
| Operational Window Observed | October 2024 – August 2026 |
| Attribution | Unclear; evidence points to a possible Costa Rica-based operator |
How the Attack Works
Finding and abusing exposed Docker daemons
Carbonato scans for Docker hosts that expose their daemon API on port 2375 without authentication — a well-known but still common misconfiguration. Once found, the malware connects directly to the exposed API and instructs the Docker daemon to launch a privileged container, which grants it access to the underlying host rather than just the isolated container environment.
Establishing persistence
With host-level access, Carbonato:
- Opens reverse SSH tunnels back to attacker infrastructure
- Installs an SSH server configured with operator-controlled keys, giving the attacker durable remote access
- Notifies operators of the new foothold via Telegram
- Installs itself using multiple redundant persistence mechanisms — cron jobs, systemd timers,
rc.local, and OpenRC hooks — so that removing any single one does not fully evict the malware
Deploying an AI agent as the operational interface
Rather than relying solely on scripted commands, Carbonato installs Hermes Agent, an AI agent framework, configured with a custom persona named "GH0ST" that overrides its default behavior. Attackers then issue tasking instructions to the agent through Telegram, and the AI agent autonomously:
- Collects credentials, API keys, SSH keys, and access tokens present on the compromised host
- Executes commands on the operator's behalf
- Returns results back through the Telegram channel
This effectively turns each compromised Docker host into an AI-operated node that can be tasked in natural language rather than requiring bespoke scripts per action.
Worm propagation
Separate scripts installed on compromised hosts scan attached networks every five minutes for additional Docker daemons exposing the same unauthenticated API, allowing Carbonato to spread laterally across reachable infrastructure without further operator involvement.
Impact Assessment
| Impact Area | Description |
|---|---|
| Host compromise | Privileged container escape grants attackers effective control of the underlying Docker host, not just an isolated container |
| Credential and secrets theft | The AI agent actively collects API keys, SSH credentials, and access tokens from infected infrastructure |
| Persistence resilience | Four redundant persistence mechanisms make full remediation significantly harder than removing a single cron job or service |
| Autonomous operation | Natural-language tasking via an AI agent lowers the operational skill required to act on compromised infrastructure at scale |
| Lateral spread | Five-minute network scanning for additional exposed Docker daemons enables rapid worm-like expansion across reachable infrastructure |
| Attribution uncertainty | Evidence points toward a possible Costa Rica-based operator, but attribution remains unconfirmed |
Recommendations
For DevOps and infrastructure teams
- Never expose the Docker Engine API on port 2375 without authentication. Require TLS client-certificate authentication (port 2376) or bind the daemon socket to localhost/a private network only.
- Audit all hosts for Docker daemons reachable from the network, including cloud instances and internal segments — Carbonato's propagation script actively scans for exactly this misconfiguration.
- Restrict container privilege escalation: avoid running containers in privileged mode unless explicitly required, and enforce this via policy (e.g., admission controllers in orchestrated environments).
For detection and response teams
- Monitor for the indicators ThreatDown identified: files or configuration referencing a "GH0ST" persona, a
CARBONATO_API_KEYsetting, unexpected Telegram network traffic from infrastructure hosts, and reverse SSH tunnels toward AS262145. - Alert on new SSH servers or unauthorized SSH keys appearing on container hosts outside of your normal provisioning process.
- Review cron, systemd timer,
rc.local, and OpenRC configurations on Docker hosts for unfamiliar entries — Carbonato relies on persistence across all four to survive partial cleanup. - Treat any host found running an unauthenticated exposed Docker API as compromised until proven otherwise, and rotate all credentials, API keys, and tokens that host had access to.
For organizations adopting AI agent frameworks
- Recognize that AI agent frameworks like Hermes Agent are now being weaponized as post-exploitation tooling, not just legitimate automation — treat unexpected AI agent processes on production infrastructure as a serious incident indicator.
- Apply the same access controls and monitoring to internal AI agent deployments that you would to any other privileged automation with credential access.
Key Takeaways
- Carbonato is a worm-capable botnet that targets Docker hosts with unauthenticated exposed APIs (commonly port 2375) to gain privileged host access.
- After compromise, it establishes durable access via reverse SSH tunnels and four redundant persistence mechanisms (cron, systemd timers,
rc.local, OpenRC). - Uniquely, Carbonato installs the Hermes Agent AI framework with a custom "GH0ST" persona, letting attackers task compromised hosts in natural language over Telegram rather than through bespoke scripts.
- The malware self-propagates, scanning attached networks every five minutes for additional exposed Docker daemons.
- ThreatDown's findings, drawn from an exposed operator registry spanning October 2024 to August 2026, suggest this campaign has been running for nearly two years before public disclosure.
- Defenders should treat any Docker Engine API exposed without authentication as an active compromise risk and monitor specifically for the GH0ST/Hermes Agent and AS262145 indicators.