CARBONATO Turns Exposed Docker Hosts Into an AI-Assisted Credential Theft Network

Open Docker APIs provide the initial foothold

CARBONATO is a Docker-based botnet that combines conventional server compromise techniques with an open-source AI agent. Active since at least October 2024, the operation seeks credentials—particularly API keys for AI platforms—that can subsidize the operators’ own large language model gateway.

The botnet targets Docker daemons accepting unauthenticated connections on TCP port 2375. Rather than exploiting a disclosed software flaw, CARBONATO abuses an insecure deployment configuration that gives remote clients access to the Docker API.

No specific affected Docker versions have been disclosed. No CVE or CISA Known Exploited Vulnerabilities entry has been associated with the campaign.

After identifying an exposed daemon, the attackers use the API to create a privileged container and mount the host filesystem inside it. This arrangement allows commands launched from the container to affect the underlying server, turning control of Docker into control of the host.

Researchers investigating CARBONATO uncovered the operation after locating an internet-accessible container registry that did not require authentication. During one day of passive, read-only collection, they retrieved 4.3 GB of image data spanning 59 repositories, 234 tags, and 605 verified file blobs.

The registry leaked more than malware images. Docker image configuration histories exposed command-and-control addresses, bot tokens, and a password shared by the operators for access to their AI gateway.

Privileged containers become persistent host access

CARBONATO’s initial deployment component is entry.sh version 5.3, described as a tier-one script. Once running, it creates a reverse SSH tunnel from the victim to relay infrastructure in Costa Rica.

The remote tunnel port is not selected randomly. CARBONATO derives it from the MD5 hash of the victim’s IP address, allowing an operator who knows that address to calculate the expected reconnection port.

The script also installs an SSH server and adds an operator-controlled public key. It then reports the new compromise through Telegram, sending the container ID, hostname, IP address, and country. The deployment messages use voseo Spanish, the regional form built around “vos.”

Several mechanisms help the malware survive reboots and attempted cleanup:

• cron jobs;
• systemd timers;
• rc.local;
• OpenRC;
• immutable file attributes intended to impede deletion or modification.

A watchdog component monitors the installation. If the malicious container disappears, the watchdog retrieves the implant from the exposed registry and deploys it again.

CARBONATO also tries to make its processes look routine. The container is named systemd-resolved, while a counterfeit banner imitates the systemd-networkd resolver. Process arguments are manipulated to resemble the kernel worker thread [kworker/u2:0].

These disguises may frustrate superficial process reviews, but they do not make the activity indistinguishable from legitimate system services. A privileged container mounting the host filesystem, establishing reverse SSH connectivity, and contacting Telegram remains a strong investigation lead.

Network propagation runs without an AI model

Although AI is central to CARBONATO’s interactive command system, it is not responsible for the botnet’s self-propagation.

Every five minutes, a script examines networks attached to the infected host, including Docker bridge networks. It then scans nearby /24 address ranges for systems exposing a Docker daemon on port 2375.

When it finds a reachable daemon, CARBONATO checks whether the target is already infected. If not, it deploys the same malicious environment through the Docker API. The newly compromised machine begins scanning in turn.

This creates a repeatable expansion mechanism that requires no new Telegram instruction and no model-generated command. It may also allow a compromise that begins on one exposed server to move into adjacent network segments visible through that host.

The immediate victims are administrators and organizations running unauthenticated Docker APIs. However, the consequences extend beyond container workloads because the privileged mount provides access to the host filesystem and locally stored secrets.

Hermes Agent is repurposed through its persona file

The implant installs Hermes Agent, an MIT-licensed open-source framework developed by Nous Research. CARBONATO does not modify the framework’s underlying code. Instead, it changes the instructions that define how the agent behaves.

The operators replace the contents of the SOUL.md persona file with a 39-line prompt and rename the agent “GH0ST.” Those instructions direct it to operate as a post-exploitation tool, execute Telegram-delivered tasks, preserve access, and collect credentials.

This design complicates detection based solely on software inventory. Finding hermes-agent does not prove that a server is infected because the framework has legitimate uses. Defenders need to examine its configuration, persona instructions, surrounding persistence mechanisms, and communications.

The malicious persona prioritizes credentials for AI services ahead of SSH credentials, general access tokens, and database secrets. It specifically names 14 providers and technologies:

• OpenAI
• Anthropic
• Google
• Gemini
• OpenRouter
• Together
• Groq
• Mistral
• Cohere
• LocalAI
• Ollama
• vLLM
• LiteLLM
• One API

The operators’ LLM gateway was reported online on September 3 and running on a free tier. It advertised 12 models while making 27 available through its API.

In CARBONATO’s operating loop, an attacker sends a task through Telegram. Hermes forwards the request and the malicious SOUL.md persona to the gateway. A selected model generates terminal commands, reviews their output, and chooses subsequent steps. Results return to the same Telegram chat used for deployment notifications.

The model therefore supplies an adaptive command interface. It can respond to differences between compromised systems without requiring the operators to create separate scripts for every host. The human operator still initiates tasks, while the LLM translates those objectives into commands and follow-up actions.

Stolen AI keys help finance further activity

CARBONATO’s focus on AI credentials gives the campaign a self-funding dimension. Stolen API keys can shift model usage costs onto victims while providing the botnet with continued access to external inference services.

A compromised key may also expose account-specific usage, quotas, or connected applications, depending on the service and the permissions attached to that credential. The exact number of stolen keys and affected organizations is not known.

The operation presents several overlapping risks: persistent remote access, privileged command execution, theft of multiple credential classes, automated network spread, and model-assisted post-exploitation. No formal severity rating has been assigned.

The exposed registry plays two roles. It distributes the implant to infected hosts, but its weak access controls also leaked operational data that helped reveal the campaign.

Evidence suggests a possible connection to Costa Rica, although it does not establish the operators’ physical location. Fourteen of 162 examined image configurations contained UTC-06:00 timestamps consistent with Costa Rica’s time zone. The Telegram handle Carbo506 includes the country’s +506 calling code, and reverse SSH connections terminated in AS262145, a Costa Rican network.

The use of voseo Spanish adds a linguistic clue. None of these indicators is conclusive, and infrastructure in Costa Rica could be controlled remotely from another country.

What administrators should inspect and lock down

The primary defensive measure is to prevent unauthenticated network access to the Docker daemon API. Port 2375 should not be exposed to untrusted networks, and access must be restricted to authorized systems.

Container registries likewise need authentication and limited network exposure. An open registry may reveal embedded secrets, image history, internal tooling, and deployable malware components.

Defenders investigating possible CARBONATO infections should look for:

• /root/.hermes/SOUL.md containing the name GH0ST;
• .env files containing CARBONATO_API_KEY;
• unexplained outbound Telegram traffic from servers;
• privileged containers named systemd-resolved;
• reverse SSH connections that lack an approved administrative purpose;
• unexpected SSH keys, cron entries, systemd timers, rc.local changes, or OpenRC persistence;
• files marked immutable without a documented operational reason;
• recurring scans for TCP port 2375 across local /24 networks.

Administrators should not blocklist Hermes Agent merely because it is installed. Investigation should focus on malicious persona content and the surrounding behavior.

Organizations should also inventory AI API keys stored in infrastructure, rotate exposed or unexplained credentials, and monitor subsequent usage. In this campaign, those keys are not incidental findings. They are a primary target and a resource intended to sustain the botnet’s AI-assisted operations.