A New Breed of Malware Threatens Docker Hosts with AI-Powered Hijacking
Malicious actors have unleashed a sophisticated botnet malware called Carbonato, which uses artificial intelligence (AI) agents to infiltrate and take control of exposed Docker hosts. This highly advanced threat exploits vulnerabilities in Docker daemons, allowing the attackers to install the Hermes Agent AI framework and gain unauthorized access.
The discovery was made by ThreatDown researchers at Malwarebytes, who uncovered operational evidence spanning over a year, from October 2024 to August 2026. The archive revealed details about the botnet, including its spread across Docker hosts with exposed APIs on port 2375 without authentication. This vulnerability allows the malware to connect to the API and instruct the daemon to launch a privileged container, giving it control over the host.
Once inside, Carbonato opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram. The AI agent framework Hermes Agent is installed on the hosts, using an agent named “GH0ST,” which handles task commands received through Telegram, including collecting sensitive data such as AI API keys, SSH credentials, access tokens, and more.
The researchers describe this process as an operator-driven exchange involving an “interactive command loop” between the AI agent and the attackers. This allows for a high degree of flexibility and adaptability in the attacks, making it challenging to detect and respond to them.
One notable aspect of Carbonato is its worm-like capability, which enables it to spread to other exposed Docker daemons on attached networks every five minutes. Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop.
While ThreatDown could not attribute Carbonato to any known threat clusters, their investigation points to Costa Rica as a possible location of the operator. To prevent infection, researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.
The emergence of Carbonato highlights the growing sophistication of AI-powered attacks in the wild. As defenders, it’s essential to stay ahead of these threats by validating, deciding, fixing, and re-validating at machine speed. By taking proactive measures to secure our infrastructure and staying informed about the latest threats, we can mitigate the risk of falling victim to such sophisticated attacks.
To keep your Docker hosts safe from Carbonato and similar threats, make sure to:
* Require authentication on registries
* Keep Docker daemon APIs off the network
* Monitor for signs of infection, including a GH0ST persona file, CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.
Source: Bleeping Computer — 2026-09-24