Carbonato Exploits Exposed Docker APIs and Deploys GH0ST AI Agent

Researchers documented the Carbonato botnet, which gains access through unauthenticated remote Docker APIs and uses a modified persona of the Hermes Agent framework on compromised hosts.

Carbonato Docker botnet targets Docker daemons accessible through remote APIs without authentication, typically on TCP port 2375. After gaining access, it deploys a privileged container, establishes persistence, and uses the open-source Hermes Agent framework with an attacker-modified persona called GH0ST.

The ThreatDown team brought attention to the campaign. According to independent reporting, this does not involve exploitation of a new Docker or Hermes Agent vulnerability. The entry point is an administrative Docker interface exposed without the necessary protection.

Carbonato Docker botnet Uses Privileged Access

The Docker API allows containers and host configuration to be managed. If the daemon is remotely accessible without authentication, an attacker can create containers with extensive privileges. Docker warns in its documentation that unsecured remote access to the daemon can lead to unauthorized root access on the host.

In the case of Carbonato, the malware reportedly launches a privileged container with access to the host system, based on available findings. It then establishes persistence and scans for other accessible Docker interfaces. This approach allows the campaign to spread to other inadequately protected systems, but it has not been confirmed that all interfaces the malware was able to find were compromised.

Hermes Agent Receives Modified GH0ST Persona

After compromising a host, Carbonato deploys the unmodified open-source Hermes Agent framework. However, the attackers modify the SOUL.md personality file and refer to the resulting agent as GH0ST. According to published information, it receives tasks through Telegram.

Reported tasks include collecting AI API keys, SSH credentials, tokens, and other data. In this case, the agent framework is used only after the host has been compromised. The main security issue is therefore not Hermes Agent itself, but a publicly or otherwise inadequately protected Docker administrative interface.

It has not been independently measured whether using an AI agent makes this campaign more effective than conventional attack scripts and command-and-control servers. The number of victims, the current scope of the activity, and the operators’ identities have likewise not been confirmed.

What Docker Administrators Should Check

The risk primarily affects Docker hosts whose API is accessible from the internet or from an inadequately restricted network. Administrators should verify that the Docker daemon is not listening on a public interface, particularly on unencrypted port 2375.

  • Remove public exposure of the remote Docker API if it is not necessary.
  • Restrict access to trusted systems and networks.
  • Use SSH or TLS with client authentication for remote management, as recommended by Docker.
  • Check for unexpected connections to Telegram, reverse SSH tunnels, and artifacts related to GH0ST.
  • Check Docker hosts for the CARBONATO_API_KEY variable.

Further findings may provide additional indicators of compromise, malware samples, or confirmed data on the number of affected systems. It will also be important whether researchers document new active exploitation or provide evidence about the operators’ origins.

Sources

  • ThreatDown – Threat Intelligence – The initial researcher states that it uncovered CARBONATO as a Docker botnet built around an AI agent.
  • BleepingComputer – Independently summarizes the exploitation of an unauthenticated Docker API, the privileged container, persistence, and deployment of Hermes Agent with the GH0ST persona.
  • Docker Docs – Configure remote access for Docker daemon – Officially warns that unprotected remote access to the Docker daemon can allow unauthorized root access; documents TLS and ports 2375/2376.
  • The Hacker News – Recent reporting on ThreatDown’s findings and the use of Telegram-controlled Hermes Agent.

Verified and updated: 09/28/2026 15:27

Tags
Sharing

Súvisiace