Carbonato Botnet Uses Hermes Agent to Take Over Exposed Docker Hosts
Summary
Malwarebytes researchers report that Carbonato targets unauthenticated Docker APIs, installs Hermes Agent, and uses Telegram commands, persistence mechanisms, and network scanning to control hosts and spread.
Key points
- Carbonato targets Docker daemons exposed without authentication on port 2375.
- It uses the Docker API to launch a privileged container and access the host.
- The malware installs Hermes Agent with a GH0ST persona to carry out operator-directed tasks through Telegram.
- It can collect credentials and tokens, run commands, and return results to operators.
- Reverse SSH tunnels and cron, systemd, rc.local, and OpenRC mechanisms support access and persistence.
- Scripts scan connected networks every five minutes for other exposed Docker hosts.
- ThreatDown researchers could not attribute Carbonato to a known threat cluster; they cited Costa Rica as a possible operator location. They recommend keeping Docker APIs off the network and requiring registry authentication.
Article Details
- Attack Vectors
- Carbonato targets Docker daemons exposed on port 2375 without authentication, then launches a privileged container to access and control the host.
- The malware scans networks attached to compromised hosts every five minutes and spreads by pulling its implant from a registry onto other exposed Docker hosts.
- Carbonato installs Hermes Agent with a GH0ST persona and uses Telegram for operator commands and deployment reports.
- The malware establishes reverse SSH tunnels and installs an SSH server with the operators’ key.
- Persistence is configured through cron jobs, systemd timers, rc.local, and OpenRC hooks.
- Defensive Notes
- Keep Docker daemon APIs off the network and require authentication on registries.
- Investigate GH0ST persona files, the CARBONATO_API_KEY setting, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145 as reported signs of compromise.
MITRE ATT&CK
T1005 · Data from Local SystemHermes Agent collects AI API keys, SSH credentials, access tokens, and other data from compromised hosts.T1021.004 · SSHThe malware opens reverse SSH tunnels and installs an SSH server using the operators’ key.T1037.004 · RC ScriptsCarbonato uses rc.local as a persistence mechanism.T1053.003 · CronCarbonato configures cron jobs for persistence.T1059 · Command and Scripting InterpreterThe GH0ST agent writes and runs terminal commands on compromised hosts in response to operator tasks.T1071.001 · Web ProtocolsThe malware uses Telegram to receive operator commands and send deployment reports and task results.T1543.002 · Systemd ServiceCarbonato configures systemd timers for persistence.T1547.014 · Active SetupCarbonato uses OpenRC hooks for persistence.T1595.001 · Scanning IP BlocksCarbonato scripts scan networks attached to compromised hosts every five minutes for exposed Docker daemons.T1610 · Deploy ContainerCarbonato instructs the Docker daemon to launch a privileged container on the host.