Malware · · 4 min read
Carbonato breaks into open Docker hosts and installs an AI agent
The botnet spreads through Docker daemons left open on port 2375, then tells an off-the-shelf AI agent to steal API keys first.
On September 22, 2026, ThreatDown published a botnet it calls Carbonato. It doesn’t email you, and it doesn’t install from a link on a phone. It looks for computers that have left the Docker engine open on the network with no login, takes the host, and then installs an ordinary open-source AI agent whose instructions say to steal API keys first.
If you don’t run Docker, you can stop after the next paragraph. There is nothing to click and nothing to “clean.”
What they found
In August, ThreatDown came across a Docker registry in the United States that had been reachable with no password since May, on port 5000. One day of read-only collection pulled 59 repositories, 234 image tags, 605 verified blobs and 4.3 GB. Image dates in the archive run from October 2024 through August 2026. Two product lines share it: a factory for counterfeit cryptocurrency wallet apps, and the botnet.
The registry wasn’t only a leak. Infected machines pull the implant back down from it, so it is also the update server. Configuration left in the images included command addresses and a password for the operation’s own language-model gateway. On September 3, ThreatDown says, six of seven known registries were still online, along with the phishing sites, a content-delivery network and that gateway.
BleepingComputer’s September 24 account matches those figures and notes that ThreatDown could not tie the crew to a named group.
How a host gets taken
Docker is the tool that runs apps in containers. Its daemon is the process that creates them. Docker’s own security notes say the daemon runs as root, and that anyone who can talk to it can do what root can do on the host. Port 2375 is the unencrypted, unauthenticated way of exposing that API. Carbonato searches for it.
When it finds one, ThreatDown says, it starts a privileged container with the host’s filesystem mounted and with the host’s process and network namespaces. From there it runs commands on the machine itself, not just inside a sandbox. A script opens a reverse SSH tunnel back to a relay ThreatDown places in Costa Rica, installs the crew’s key, and posts a deployment report to Telegram with the container ID, hostname, IP address and country. The report is in voseo Spanish. ThreatDown says that narrows the language, and that it does not by itself name a country.
The implant is built to look boring and to survive a reboot. The container is named like systemd-resolved. Process arguments imitate a kernel thread. Persistence is hooked through cron, systemd timers, rc.local and OpenRC, and those files are marked immutable. Watchdogs notice if the container disappears and pull it again from the registry.
The agent is a stock framework with a new persona
Once the host is held, the implant installs Hermes Agent, an MIT-licensed framework from Nous Research, without modifying the framework. It overwrites one file, SOUL.md, with a 39-line persona. ThreatDown says that persona tells the agent to follow tasks from Telegram, to stay persistent, and to treat AI API keys as the first thing to take, ahead of SSH credentials, access tokens and databases. The prompt names 14 providers.
Tasks arrive in Telegram. The agent forwards the task, plus the persona, to the crew’s language-model gateway, runs the commands the model writes, and sends the result back to the same chat. ThreatDown says the gateway was on a free tier, advertising 12 models and serving 27 through its API, which is why the persona is so interested in keys. The model does not do the spreading. Every five minutes a script lists the networks on the host and scans each nearby /24 for another open daemon on port 2375.
What to check if you run Docker
- The Docker API should not answer from the network without authentication. If port 2375 is reachable from the internet, or from other machines, with no login, that is the whole path Carbonato uses. Don’t publish the daemon socket. If you need remote access, use SSH, or TLS with certificates, the way Docker’s docs describe.
- If 2375 was open, treat keys on that host as stolen. The persona asks for AI API keys first, then SSH keys, tokens and database credentials, and it wants them in plaintext. Rotate anything that lived in environment files, shell history or a
.envon that machine. A password you only typed into a website elsewhere isn’t in this pile. - A container named like a system service is not one.
systemd-resolvedis a real Linux service. A Docker container using that name, or a process dressed up as a kernel thread, is worth a closer look on a host that was exposed.
Phones, home routers and ordinary Windows PCs are not how this one spreads.
Sources
- CARBONATO: a botnet built around an AI agent, ThreatDown, September 22, 2026.
- New Carbonato malware uses AI agents to hijack exposed Docker hosts, BleepingComputer, September 24, 2026.
- Docker daemon attack surface, Docker documentation.
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.