As reported by BleepingComputer, ThreatDown researchers at Malwarebytes have uncovered Carbonato, a botnet that compromises Docker hosts with unauthenticated APIs on port 2375, deploys privileged containers, and — most notably — installs the Hermes Agent AI framework to drive an interactive command-and-control loop via Telegram. The operational archive spanned October 2024 through August 2026, indicating a long-running, quietly maturing campaign.

Threat Alert: As reported by BleepingComputer, ThreatDown researchers at Malwarebytes have uncovered Carbonato, a botnet that compromises Docker hosts with unauthenticated APIs on port 2375, deploys privileged containers, and — most notably — installs the Hermes Agent AI framework to drive an interactive command-and-control loop via Telegram.

Shield53 views this as more than another crypto-mining or DDoS botnet. The deliberate integration of an LLM-backed agent — named GH0ST with a custom SOUL.md persona — into the post-exploitation workflow signals a structural shift in how low-skill operators can now run high-skill intrusions. The agent interprets task descriptions, writes terminal commands, evaluates output, and decides next steps autonomously, reporting back through the same Telegram channel used for deployment notifications. This collapses the traditional gap between initial access and meaningful post-exploitation.

Why This Matters Beyond Docker

The exposed Docker daemon API on port 2375 is a well-documented, years-old misconfiguration that CISA and vendor guidance have repeatedly warned about. That attackers are still finding sufficient victims to sustain a worm-like scanning loop — checking attached networks every five minutes — tells us two things: basic hygiene failures remain rampant in cloud and container environments, and threat actors no longer need to invest in sophisticated tradecraft when misconfigurations and AI agents do the heavy lifting.

The combination of worm propagation plus an AI-driven interactive C2 loop means a single exposed host can cascade into infrastructure-wide compromise with minimal operator involvement.

Who Is Most Exposed

Why This Matters Beyond Docker
Cloud and DevOps teams running Docker daemons with -H tcp://0.0.0.0:2375 and no TLS or authentication
Research and academic environments where Docker APIs are commonly left open for convenience
CI/CD pipelines that expose Docker sockets or APIs to broader networks than intended
Organizations using Kubernetes with Docker as the container runtime (deprecated but still present in legacy stacks)

The persistence layer is particularly aggressive: cron jobs, systemd timers, rc.local, and OpenRC hooks together ensure survival across reboots and across different Linux distributions. The reverse SSH tunnel with operator-controlled keys means that even if the AI agent is removed, a backdoor channel likely remains.

The AI Agent Angle

Hermes Agent is not inherently malicious — it is a framework. But its abuse in Carbonato and the previously documented Gambit card-skimming operation (600,000 stolen credit card details) establishes a pattern. Offensive use of AI agent frameworks is moving from proof-of-concept to operational mainstay. Defenders should expect more campaigns to leverage agentic AI for credential harvesting, lateral movement decisioning, and automated exfiltration — especially because these frameworks lower the barrier to running complex multi-step intrusions without dedicated operators at the keyboard.

Shield53 Recommendations

Immediate Actions

  • Audit Docker daemon exposure: Scan your estate for port 2375 and 2376 listeners. Use docker context ls and review daemon startup flags. If the API must be exposed, require TLS mutual authentication and bind to a VPN or private interface only.
  • Hunt for Carbonato indicators: Look for unexpected privileged containers, unauthorized SSH keys in authorized_keys, suspicious cron entries, systemd timers with generic names, and outbound connections to Telegram API endpoints from container hosts.
  • Disable the unencrypted Docker API: Remove -H tcp://0.0.0.0:2375 from daemon configuration. Use the Unix socket by default. Restart the daemon and verify with docker info.
  • Contain and eradicate: If compromise is confirmed, assume persistence across multiple mechanisms. Rebuild the host from a known-good image rather than attempting in-place cleaning. Rotate all credentials, API keys, and SSH keys that were accessible from the host.

Strategic Hardening

  • Adopt podman or containerd for environments where root-privileged Docker daemons are unnecessary
  • Implement network segmentation so container hosts cannot reach the internet on arbitrary ports
  • Deploy runtime container security (Falco, Aqua, Sysdig) to alert on privileged container creation and unexpected process execution
  • Monitor for Hermes Agent and similar AI frameworks in your environment — their presence on production hosts is a red flag regardless of stated intent
  • Restrict outbound Telegram API traffic from server and container networks unless there is a documented business need

The Carbonato campaign is a preview of the next threat landscape: self-propagating malware augmented by AI agents that can reason through post-exploitation tasks. The mitigation for the initial access vector has been available for years. The urgency now is closing that gap before the agent layer makes these intrusions autonomous enough to scale without human operators at all.