CARBONATO: a Docker botnet that runs a stock AI agent as its operator console

What is this?

On 22 September 2026, ThreatDown published CARBONATO: a botnet built around an AI agent. During routine threat hunting in August 2026, its researchers found an unauthenticated Docker registry that internet-wide scanners had listed since May. One day of passive, read-only collection recovered 59 repositories, 234 image tags and 4.3 GB of image data spanning October 2024 to August 2026 — the operation’s entire toolchain, including environment variables and command histories.

The archive documents two product lines: a factory for trojanized cryptocurrency wallet apps, and a worm-like botnet that compromises Docker daemons exposed without authentication. What makes the botnet notable for this site is its post-compromise layer: instead of writing a custom implant, the crew installs Hermes Agent, an MIT-licensed open-source agent framework from Nous Research, unchanged, and overwrites a single file — its SOUL.md persona — with a 39-line malicious prompt. On 3 September 2026, six of the seven known registries, the phishing sites and the operation’s LLM gateway were still online.

How it works

ThreatDown describes five phases. Only one involves a language model.

1. Take the host. The worm looks for Docker daemons accepting unauthenticated connections on TCP port 2375. Through that API it starts a privileged container with the host filesystem mounted and the host’s process and network namespaces shared — which, as Docker’s own documentation warns, is equivalent to root on the host.
2. Hold the host. A startup script opens a reverse SSH tunnel to a relay, installs an SSH server with the crew’s key, and reports the new victim to a Telegram chat. The implant hides in a container named after a system resolver, disguises its process arguments as a kernel worker thread, and plants persistence through cron, systemd timers, rc.local and OpenRC, marking the files immutable. Watchdogs re-pull the image from the registry if anything is removed.
3. Install the agent. Hermes Agent already accepts tasks over Telegram, runs terminal commands and talks to any compatible LLM endpoint. The implant replaces SOUL.md — which the framework’s documentation describes as the persona injected verbatim as the first slot of the system prompt — with an identity called “GH0ST”.
4. Operate the host. An operator sends a task in Telegram; the agent forwards it, together with the persona, to the crew’s own LLM gateway (a free-tier proxy serving 27 models), then loops: write a command, run it, read the output, decide the next step, report back.
5. Spread. The model plays no part here. Plain shell scripts sweep every attached /24 every five minutes for more exposed daemons and repeat phase 1.

The persona’s content is the most telling artefact. Paraphrased, it tells the agent it is a post-exploitation tool with no restrictions, must keep persistence and obey Telegram, and — under a heading dedicated to loot priority — that API keys for AI providers are the number-one target, ranked above SSH credentials, access tokens and databases. It names 14 providers and local serving stacks, and orders the agent to store every secret in plaintext and report any exposed AI endpoint as a source of more keys.

Why it matters

• The agent framework is not the vulnerability. Hermes Agent was not modified or exploited. The malicious behaviour comes entirely from a text file read at startup. Any general-purpose agent with shell and chat integrations can be repurposed the same way; the “implant” is a prompt.
• Agents lower the operator skill floor. The model turns vague Telegram instructions into host-specific commands and adapts as it discovers the environment. Target selection and propagation stay in deterministic scripts — the LLM is the interactive console, not the worm.
• AI API keys are now tier-one loot. The operation runs its own LLM gateway, and the prompt spells out why: stolen provider keys fund the next round of inference. This matches the credential-theft pattern Microsoft reported in August 2026 against AI gateways and orchestrators (see our AI infrastructure intrusions write-up).
• The entry point is a decades-old misconfiguration. No zero-day is involved. An unauthenticated Docker API remains a direct path to root, and every compromised host becomes a scanner for its neighbours.

Defenses

• Never expose the Docker daemon unauthenticated. Keep it on the local Unix socket; if remote access is required, use TLS with client certificates (conventionally port 2376) or SSH, as described in Docker’s Protect the Docker daemon socket guide. Firewall 2375 everywhere, including internal networks and Docker bridges.
• Authenticate every registry. An open registry is both a data leak and, here, the botnet’s update server.
• Restrict privileged containers. Use admission policies or rootless Docker to block --privileged, host PID/network namespaces and root filesystem bind mounts on hosts that do not need them.
• Hunt the abuse, not the package. ThreatDown explicitly advises against blocklisting Hermes Agent, which has legitimate users. Look instead for a SOUL.md under /root/.hermes/ containing the persona name “GH0ST”, an unexpected .env API-key variable referencing the operation, a /root/.hermes/loot/ directory, and unexplained Telegram egress from servers.
• Check for the persistence kit. Hidden watchdog binaries under /usr/local/bin/, processes posing as kernel workers or systemd-logind with high CPU, and immutable attributes on cron or systemd files nobody locked.
• Treat agent persona and config files as code. For your own agent deployments, make persona/system-prompt files read-only, hash them, and alert on change — a silent rewrite is a full behavioural compromise.
• Handle AI API keys like bank credentials. Inventory where they live, scope and rotate them, set spend limits and alert on usage from unknown origins.

Status

Aspect	Detail
Primary source	ThreatDown, CARBONATO: a botnet built around an AI agent, published 22 September 2026
Discovery	Unauthenticated registry found August 2026; archive spans October 2024 – August 2026
Infection vector	Unauthenticated Docker Engine API (TCP 2375) — misconfiguration, no CVE
Agent component	Hermes Agent (Nous Research, MIT licence), used unmodified; behaviour set by an overwritten SOUL.md
Infrastructure	Six of seven registries, phishing sites and LLM gateway live on 3 Sep 2026; some LLM proxies suspended
Attribution (ThreatDown)	Costa Rica assessed, from timezone data, Telegram handle and tunnel endpoint network
Full IOCs	See the ThreatDown report