Carbonato Botnet Compromises Exposed Docker Hosts to Steal AI API Keys
Summary
ThreatDown researchers found Carbonato exploiting unauthenticated Docker daemons exposed on port 2375. It installs a persistent implant and a Telegram-controlled AI agent to collect credentials, especially AI API keys, and spreads to other reachable Docker hosts.
Key points
- Carbonato targets Docker hosts with unauthenticated daemons exposed on port 2375.
- Attackers launch a privileged container with access to the host, then install an implant for persistent remote access through an SSH reverse tunnel.
- An AI agent based on Hermes Agent follows a short prompt to execute Telegram commands, persist, and collect credentials.
- The agent prioritizes AI API keys, while also seeking access tokens, SSH keys, and databases.
- Separate malware scripts scan nearby networks for other exposed Docker services and repeat the infection process.
- ThreatDown linked the botnet to attacker-controlled infrastructure that also distributed Trojanized cryptocurrency wallet apps; it did not attribute the campaign to a specific actor.
- Defenders should avoid exposing the Docker daemon API, require registry authentication, investigate persistence and suspicious network activity, and inventory, rotate, and monitor AI API keys.
Article Details
- Event Type
- Discovery of the Carbonato botnet compromising exposed Docker hosts and installing an AI agent to collect credentials.
- Impact
- Compromised hosts are used for persistent remote access and to spread to reachable Docker hosts. The botnet prioritizes theft of AI API keys and also seeks access tokens, SSH keys, and databases.
Malware
Vendors
DockerA newly discovered Docker botnet is implanting AI agents onto compromised hosts in order to send stolen credentials back to the attackers.ThreatDownThreatDown researchers recently uncovered Carbonato, a botnet that compromises servers running unauthenticated Docker daemons (the background process that manages Docker containers, images, networks, and related
Products
DockerA newly discovered Docker botnet is implanting AI agents onto compromised hosts in order to send stolen credentials back to the attackers.Hermes AgentThe agent is based on Hermes Agent, an open source agent framework from Nous Research that is licensed under the MIT License. This is perhaps the most novel aspect of the botnet. Embedded on the compromised Docker host