Threat actors are deploying a new botnet, codenamed CARBONATO, that embeds an AI agent within compromised Docker servers to automate sensitive tasks on behalf of its operators. The attack’s root lies in misconfigured Docker setups that expose critical services without proper authentication. Once attackers breach a host, they launch privileged containers, achieve persistence through various system mechanisms, and scan connected networks for additional vulnerable systems.
How CARBONATO Works
The campaign initiates when Docker daemon APIs are left exposed to the public. Attackers exploit this by deploying privileged containers with full host-level access, then establish reverse SSH tunnels to relay control servers. A backdoor SSH server and container watchdog scripts are also used to maintain stealth and persistence. Scheduled tasks, systemd timers, startup scripts, and other services ensure the implant survives reboots and removal efforts.
Within compromised containers, operators install an open-source framework called Hermes Agent. Rather than modifying the framework itself, the attackers substitute its persona file with a custom script—around 39 lines—that directs the agent to do reconnaissance, gather credentials and secrets, and obey commands issued via Telegram. When operators issue a task, it’s routed through a language model gateway where prompts are translated into terminal commands that execute on the infected machine and send results back through Telegram.
Scope, Targets, and Indicators
Researchers from ThreatDown discovered CARBONATO after locating an exposed Docker registry in May 2026. That registry contained 59 repositories, 234 tags, over 600 blobs, and nearly 4.3 GB of data spanning from October 2024 to August 2026. Among the agent’s top priorities are AI API keys, SSH credentials, access tokens, and databases. The exposed registry also held trojanized cryptocurrency wallet applications, illustrating how credential theft and malware delivery are intertwined.
CARBONATO spreads via scripts that probe local networks and Docker bridges on a /24 subnet, looking for other exposed Docker daemons. The rest of the campaign—privileged container creation, persistence setup, data collection and command handling—is fully automated. To conceal itself, the botnet camouflages malicious containers, processes, and files under names and structures resembling standard Linux system components.
Researchers have published a series of Indicators of Compromise (IoCs) to help defenders spot this threat. These include specific IP addresses linked to command-and-control infrastructure, reverse shell endpoints, and known registry fleets. Also flagged are environment variables, file paths, watchdog binaries, and persistent cron or systemd tasks that suggest an implant is active.
Defensive Measures and Implications
Key mitigations include restricting Docker daemon access from public networks, enforcing authentication on registries, and monitoring for privileged containers or unusual Telegram traffic from servers. Security teams should check for unexpected persistence mechanisms and audit AI API keys—especially any associated with exposed hosts.
While the origin of the operation isn’t confirmed, artifacts such as build timestamps, communication logs, and network relay traces hint at ties to Costa Rica. That said, attribution remains tentative and unverified.
CARBONATO represents a shift in how botnets are constructed: the AI agent acts as a software proxy between operator inputs and host actions, without altering the underlying agent framework. This makes blocking or blacklisting the framework more complex—legitimate users may also rely on it. Instead, attention must be paid to the persona layer and how the framework is initialized.
What It Means
CARBONATO underscores a growing trend: AI agents are starting to be weaponized in automated compromise operations rather than simple credential-stealing malware. For security teams, this means scope of what must be monitored is expanding—from misconfigurations in infrastructure to how AI tools are being used and manipulated. Going forward, defending against threats will require deep visibility into container environments, agent behavior, and control channels like Telegram. Observing which persona files are in use and how they’re initialized may become as critical as detecting the malware framework itself.
