Nearly 60 repositories and 4.3 GB of image data sat in an unauthenticated Docker registry that yielded a revealing trace of a new botnet: Carbonato, a malware campaign that installs an AI agent framework and uses exposed Docker APIs to seize hosts.
How Carbonato compromises exposed Docker daemons
Malwarebytes’ ThreatDown researchers recovered operational evidence showing Carbonato targets Docker daemons with their API exposed on port 2375 without authentication. The malware connects to that API and instructs the daemon to launch a privileged container, which grants it broad access to the host. From there, the implant opens a reverse SSH tunnel, installs an SSH server seeded with the operators’ key, and reports the new deployment through Telegram.
For persistence the attackers deploy multiple mechanisms: cron jobs, systemd timers, rc.local, and OpenRC hooks. ThreatDown’s archive covers activity from October 2024 through August 2026 and also included artifacts tied to a separate campaign distributing counterfeit cryptocurrency wallet apps.
Hermes Agent “GH0ST” and the AI-powered command loop
Carbonato’s notable twist is the installation of the Hermes Agent AI framework on compromised hosts. The deployed agent, named “GH0ST,” replaces the default ‘SOUL.md’ persona file, and handles operator instructions relayed via Telegram.
ThreatDown describes the interaction as an operator-driven “interactive command loop.” “The model interprets the task, writes terminal commands, reads the output, and decides what to do next,” the researchers note. Hermes is used to collect AI API keys, SSH credentials, access tokens and other data, to execute commands on the victim, and to send back results to the same Telegram chat that receives deployment reports.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWorm-like propagation: five-minute scans and registry reuse
Carbonato includes worm-like capability to move laterally to other exposed Docker hosts. Scripts running on an infected machine scan networks attached to the host every five minutes for other Docker APIs exposed without authentication. Each new compromise pulls the implant from the unauthenticated registry, launches the same privileged container, and repeats the persistence and scanning loop.
ThreatDown’s enumeration of an unauthenticated registry — nearly 60 repositories, 4.3 GB of image data — provided operational artifacts that exposed this lifecycle and the reuse of images to seed fresh compromises.
Indicators, network artifacts, and recommended mitigations
ThreatDown and Malwarebytes identify several artifacts and behaviors defenders can watch for. Signs of Carbonato infection include:
- a GH0ST persona file (the overwritten ‘SOUL.md’),
- a CARBONATO_API_KEY setting present on the host,
- unexpected Telegram traffic associated with deployment reports and command handling, and
- reverse SSH tunnels targeting AS262145.
The researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries to prevent infection. Those steps target the initial vector Carbonato exploits — unauthenticated control of Docker and unauthenticated registries used to host and distribute the implant.
Operational context: Hermes abuse and attribution signals
Malwarebytes’ archive and ThreatDown analysis place Carbonato in a broader pattern of Hermes Agent abuse. Gambit, another cybersecurity company, recently documented a Hermes-driven card-skimming operation that stole 600.000 credit card details, underscoring that the same AI framework has been repurposed in multiple criminal campaigns.
ThreatDown could not attribute Carbonato to any known threat cluster. Based on artifacts recovered from the operational archive, the researchers point to Costa Rica as a possible location of the operator, but do not claim firm attribution.
Carbonato’s combination of container orchestration abuse, privileged-container implants, automated lateral scanning, and an AI agent that interprets operator tasks into commands creates a compact, repeatable kill chain. The recovered registry — with its nearly 60 repositories and 4.3 GB of images — offered a rare operational window into that chain from October 2024 through August 2026. For teams exposed to Docker APIs, the immediate technical remedy is straightforward in concept: close unauthenticated access and harden registries. The harder question the artifacts leave is how broadly Hermes-based agents will be woven into similar automated, operator-driven malware in coming campaigns.
