CARBONATO: AI-Powered Docker Botnet Targets 12 AI Platforms for Credential Theft

The CARBONATO Docker botnet exploits a fundamental Docker misconfiguration: the daemon socket bound to TCP port 2375 without authentication. Docker's remote API was designed for local administration, not internet exposure, and carries no authentication mechanism on port 2375. Any client that can reach it can create, start, stop, and inspect containers with the same authority as the root user on the host.

CARBONATO's initial access routine sends a POST request to /containers/create with three critical parameters: Privileged set to true, Binds set to ["/:/host"] mounting the host root filesystem, and NetworkMode and PidMode both set to "host" to share the host's network and process namespaces. The daemon creates the container instantly. The implant then runs nsenter with the --target flag pointing to the host's init process and --mount --uts --ipc --net flags to switch into all host namespaces, achieving kernel-level access without any credentials.

Once inside the host namespace, CARBONATO executes four parallel operations: installing an SSH server with operator-controlled keys, writing a watchdog binary to /usr/local/bin/.docker-network-monitor that restarts the implant if removed, deploying an XMRig cryptominer masquerading as the [kworker/u2:0] kernel thread, and establishing a reverse SSH tunnel to a Costa Rica-based relay at AS262145. The tunnel's destination port is derived from the MD5 hash of the victim's IP address, allowing operators to reconnect predictably without maintaining a static mapping.

The worm spreads by pulling a trojanized container image from a private registry controlled by the operators, then scanning the /24 subnet around the newly compromised host every five minutes using bash's TCP device file test: timeout 2 bash -c "echo >/dev/tcp/${network}.${i}/2375".

Hermes Agent is an open-source AI framework released by Nous Research under the MIT license. It enables an LLM to operate as an autonomous agent: receiving natural-language instructions, writing shell commands, executing them, and reporting results without human intervention at each step. CARBONATO operators modified only a single file, SOUL.md, to transform the framework into a criminal C2 engine.

The custom 39-line GH0ST persona instructs the agent to: maintain persistence on every host where it runs, accept task instructions from Telegram without ethical constraints, prioritize AI API key collection above SSH credentials and database access, store all extracted secrets in plaintext at /root/.hermes/loot/ without hashing, and route all task execution through an operator-controlled LLM gateway that the operators seeded with keys stolen from earlier victims.

This architecture eliminates the fixed C2 server that traditional botnet defenses target. There is no domain or IP to blocklist at the C2 tier: each compromised host runs its own Hermes instance, connecting outbound to Telegram's legitimate API endpoint (which cannot be blocked without disrupting legitimate Telegram usage). The operators have effectively turned the world's compromised Docker hosts into a distributed network of autonomous agents awaiting instructions over an encrypted messaging channel.

Operators who ran out of stolen API budget simply tasked GH0ST agents on recently compromised hosts to collect more. Researchers observed the live LLM gateway at 213.136.83.197 advertising 12 models and serving 27 through its API, funded entirely by stolen credentials from CARBONATO victims.

The GH0ST persona explicitly ranks AI API key collection above SSH private keys, database credentials, and cloud provider tokens. This ordering reflects the operators' business model: stolen AI API keys fund the LLM gateway that powers subsequent CARBONATO operations, removing the need to pay for compute.

Twelve platforms are targeted: OpenAI, Anthropic, Google (Gemini and Vertex AI), Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, Together AI, and OpenRouter. Researchers found a live gateway at 213.136.83.197 on the day of discovery serving 27 AI models through its public API, powered by keys collected from victims across multiple continents.

Organizations running AI development infrastructure on Docker hosts face a compounded risk: the same environment that makes local model deployment convenient creates the attack surface CARBONATO exploits. Self-hosted inference servers (Ollama, vLLM, LocalAI) run adjacent to application containers on the same Docker daemon. A single exposed port 2375 hands attackers not just the host but the model keys, the training data, and the downstream applications that consume the API.

Block the five confirmed C2 IPs at your perimeter firewall immediately. All five have been active across the CARBONATO campaign from October 2024 through the date of researcher disclosure. Hunt for the host-based artifacts listed below on every Linux server running Docker.

These rules detect CARBONATO's initial Docker API exploitation and the Hermes AI agent artifacts it installs post-compromise. Both carry experimental status; validate against your environment's log format before enabling automatic blocking.

The primary control is eliminating unauthenticated remote API access entirely. Port 2375 should never be reachable from untrusted networks. The steps below close the CARBONATO attack surface and give your team visibility into any hosts already compromised.

The CARBONATO Docker botnet marks a qualitative shift in botnet architecture. Previous campaigns automated initial access and lateral movement but relied on static C2 infrastructure: a domain or IP that defenders could blocklist to break the chain. CARBONATO replaced the C2 server with an AI agent instance on each host, accepting adaptive, natural-language operator instructions through Telegram's encrypted API.

This architecture has three defensive implications. First, blocklisting C2 infrastructure only affects the relay tunnel IPs documented above; the Hermes agent on each compromised host continues operating independently if the relay is cut. Second, the GH0ST persona can be updated remotely to change the agent's behavior, target new credential types, or pivot to destructive tasks without redeploying any binary. Third, the same open-source framework (Hermes Agent) is already being used by separate, unrelated threat groups including Chinese financial crime operators who compromised 600,000 payment card records in August 2026, suggesting the AI-as-C2 pattern will replicate across criminal ecosystems faster than traditional botnet TTPs.

The immediate defensive priority is eliminating port 2375 exposure and hunting for existing compromise. The longer-term challenge is rewriting detection playbooks that assume a static C2 domain or IP. SOC teams should add behavioral detection for AI agent framework artifacts and outbound Telegram API traffic from production server environments to their rule sets today. For context on how AI capabilities are being operationalized across the attacker landscape, the ShinyHunters WAF bypass campaign covered in our <a href='/blog/shinyhunters-peoplesoft-waf-bypass-exploitation-2026'>September 27 post</a> demonstrates how attackers iterate their tradecraft faster than static signatures can track.