CARBONATO botnet infects Docker hosts, prioritizing theft of AI provider API keys
CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.
The Watch · Security desk
What happened
- CARBONATO scans the internet for Docker daemons that accept unauthenticated connections on port 2375, a configuration thousands of hosts still leave publicly reachable.
- ThreatDown discovered the botnet, active since at least October 2024, after its operators left a container registry exposed, and pulled 4.3 GB of images in a day: 59 repositories, 234 tags, and 605 verified file blobs.
- The implant installs Nous Research's MIT-licensed Hermes Agent without modifying the code, driving the framework entirely through a swapped configuration file.
- GH0ST's overriding instruction is to steal API keys, which it ranks above SSH credentials, access tokens, and databases.
Why it matters
- What's now possible capability The exposed registry handed ThreatDown the crew's command-and-control addresses, bot tokens, and the shared AI gateway password, so blocklists and a takedown can be built from the operators' own files.
- What it costs cost Every stolen provider key turns a victim's AI account into a payer for the operators' inference, monetising a compromised host beyond the usual crypto mining or proxy resale.
- What it limits constraint There is no vulnerability to patch here, so defenders cannot wait for a fix; the only lever is whether the Docker daemon is reachable without authentication.
- What it sets up precedent Treating AI provider keys as the top prize signals where the money now sits for opportunistic crews, and more implants are likely to hunt provider keys first.
Next story · Product · 8h ago
RTX Spark laptops from six makers run AI agents on the device, starting at $2,599Confirmed2 publishers
There is no exploit in the entry step. A Docker daemon listening for unauthenticated connections on port 2375 exposes the same API an administrator uses, and CARBONATO uses it to start a privileged container with the host filesystem mounted, then runs its commands on the underlying machine through that container [4].
What lands next is built to survive a cleanup. "The container starts by running entry.sh. The script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, giving the operators a path back into the host. Its remote port is derived from the MD5 hash of the victim's IP address, so the crew can calculate the same port whenever it needs to reconnect," ThreatDown wrote [5]. The same script "installs an SSH server, adds the crew's key, and sends a deployment report to Telegram with the container ID, hostname, IP address, and country" [6].
Persistence is written into cron jobs, systemd timers, rc.local, and OpenRC, and each of those files is then marked immutable so an administrator cannot simply delete it [16]. A watchdog re-pulls the implant from the registry if the container disappears [17]. The container runs under the name "systemd-resolved" behind a fake resolver banner, and its process arguments imitate the kernel thread [kworker/u2:0], so a quick look at the process list shows nothing wrong [18].
Then comes the agent. "At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file," the report states [10]. The crew edits one file. A 39-line prompt renames the agent GH0ST [12] and, per the report, "directs it to execute tasks received through Telegram, maintain persistence, and collect credentials" [14]. Because the malice lives in the prompt and not the binary, scanning the file on disk finds an unmodified open-source framework [15].
The prompt sets a single priority above everything else. GH0ST is told to collect API keys for OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API [19]. The operators' own LLM gateway explains why: it was still answering on September 3, running on a free tier while advertising 12 models and serving 27 through its API [20]. Stolen keys pay for the inference.
Attribution points at Costa Rica without naming anyone. The reverse tunnels terminate at a relay there [5], and the deployment reports are written in voseo Spanish, the regional form that uses "vos" instead of "tu" [7]. ThreatDown says the infrastructure could be operated from somewhere else [2].
What to watch
- Whether the 14 named providers revoke and rotate keys tied to CARBONATO victims, and whether the operators' gateway password gets burned now that the registry is public.
- Whether the Costa Rica relay and the Telegram deployment channels are taken down after ThreatDown's disclosure.
- Whether other crews copy the prompt-swap technique against unmodified open-source agent frameworks to dodge binary scanning.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives35
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CARBONATO is a Docker-based botnet that has been active since at least October 2024.
- [2]
The operation appears to be linked to Costa Rica, although researchers say the infrastructure could also be used by someone operating from elsewhere.
- [3]
The bot scans for Docker daemons accepting unauthenticated connections on port 2375, a configuration that thousands of hosts still run publicly reachable.
- [4]
When it finds an exposed daemon, CARBONATO uses the Docker API to launch a privileged container with the host filesystem mounted, then runs commands directly on the underlying machine through that container.
- [5]
The container starts by running entry.sh. The script opens a reverse SSH tunnel from the victim to a relay in Costa Rica, giving the operators a path back into the host. Its remote port is derived from the MD5 hash of the victim's IP address, so the crew can calculate the same port whenever it needs to reconnect.
- [6]
The script also installs an SSH server, adds the crew's key, and sends a deployment report to Telegram with the container ID, hostname, IP address, and country.
- [7]
The deployment reports are written in voseo Spanish, the regional form that uses 'vos' instead of 'tu', which narrows the linguistic origin without naming a country.
- [8]
The implant installs Hermes Agent, an MIT-licensed open-source agent framework from Nous Research, entirely unchanged.
- [9]
ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet, which contained the attackers' entire toolchain.
- [10]
At the center of the botnet is Hermes Agent, an MIT-licensed open-source agent framework. The implant installs the framework unchanged, then overwrites its SOUL.md persona file.
- [11]
In one day of passive, read-only collection, researchers gathered 4.3 GB of image data, including 59 repositories, 234 tags, and 605 verified file blobs.
- [12]
The attackers modify only the agent's SOUL.md persona file, a 39-line prompt that renames the agent 'GH0ST'.
- [13]
The registry exposed the configuration history of the images, revealing command-and-control addresses, bot tokens, and the shared password for the attackers' own AI gateway.
- [14]
The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials.
- [15]
The malicious behavior comes from the instructions loaded when the agent starts, making the modified agent harder to detect through the binary alone.
- [16]
Persistence is layered through cron jobs, systemd timers, rc.local, and OpenRC, and every one of those files is then marked immutable so a cleanup attempt cannot simply delete them.
- [17]
A paired watchdog monitors the deployment and re-pulls the implant from the registry if its container disappears.
- [18]
The container runs under the name 'systemd-resolved' and displays a fake systemd-networkd resolver banner, while its process arguments imitate a kernel thread called [kworker/u2:0], so a quick process review sees nothing obviously wrong.
- [19]
The prompt lists 14 providers by name (OpenAI, Anthropic, Google, Gemini, OpenRouter, Together, Groq, Mistral, Cohere, LocalAI, Ollama, vLLM, LiteLLM, and One API) and ranks those API keys above SSH credentials, access tokens, and databases.
- [20]
The operation's own LLM gateway was still live on September 3, running on a free tier while advertising 12 models and serving 27 through its API.
Sources
3 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNew Carbonato malware uses AI agents to hijack exposed Docker hosts
1 article · September 24, 2026
- scworld.comNew Carbonato botnet uses AI framework to target insecure Docker daemons
1 article · September 25, 2026
- securityaffairs.comAI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
1 article · September 25, 2026
Topics and entities
Topics
- Botnets
- Container Security
- Malicious use of AI agents
- LLM API Key Theft