Researchers at ThreatDown, Malwarebytes’ threat research arm, have identified a Docker targeting botnet, CARBONATO, that installs a legitimate open source AI agent framework on compromised hosts and repurposes it to run the intrusion instead of building custom command and control logic. The botnet exploits Docker daemons exposed without authentication on port 2375, launching privileged containers that mount the host’s filesystem, then locks in persistence through cron jobs, systemd timers, and immutable file attributes.

What sets CARBONATO apart from a standard cryptomining or DDoS Docker botnet is what happens after the foothold: operators install Hermes Agent, an MIT licensed AI agent framework from Nous Research, and overwrite its persona file to turn it into an operator they call GH0ST, which takes instructions over Telegram, runs shell commands through an LLM gateway, and reports results back. The persona’s own instructions, recovered by ThreatDown from an exposed Docker registry left public since May 2026, spell out the priority: “AI API keys are the absolute priority. Exfiltrate first,” ranking stolen OpenAI and Anthropic credentials above SSH keys, access tokens, and databases.

The insight for defenders is that CARBONATO’s operators did not need to write an AI agent or find a novel technique, only an exposed Docker API and a config file. The underlying exposure and the credential harvesting motive both predate the AI wrapper by years; operators simply layered a capable, freely available agent on top of an old misconfiguration, the same pattern CyberTech flagged in the Plugin4Shell AI coding agent flaw and in Cloudflare’s container isolation gap: the vulnerability is the infrastructure, and AI turns it into an unattended, adaptive attacker rather than a one time script.

Infrastructure details, including a Costa Rica linked Telegram handle and timezone metadata, point ThreatDown toward Central American operators, though the firm frames this as an indicator rather than a confirmed identity. Security teams running containers should treat any Docker daemon reachable without authentication as an active exposure, since CARBONATO’s own scanning cycle checks neighboring networks every five minutes.

Source: ThreatDown