CARBONATO Botnet Employs AI Agent for Command Execution and Data Exfiltration on Compromised Docker Servers
A newly discovered botnet, dubbed CARBONATO, utilizes an AI agent within compromised Docker servers to interpret commands received via Telegram, prioritizing the theft of sensitive AI API keys and credentials.
Researchers have uncovered a sophisticated botnet named CARBONATO that leverages an artificial intelligence agent to operate within compromised Docker servers. This novel approach allows attackers to execute commands received through Telegram, with the AI agent acting as an intermediary to interpret requests and perform actions on the infected systems. The botnet's initial access vector exploits carelessly exposed Docker services that lack proper authentication, a common misconfiguration that can lead to widespread compromise.
Once inside a vulnerable Docker server, CARBONATO establishes persistence by launching a privileged container with extensive access to the host system. It then proceeds to scan the surrounding network for additional servers with similarly exposed Docker daemons, propagating itself without requiring direct human intervention for each new infection. ThreatDown researchers identified this operation after discovering an unauthenticated Docker registry that had been accessible since May 2026, revealing a trove of data related to the botnet's activities.
The core of CARBONATO's unique functionality lies in its use of the open-source Hermes Agent framework, modified with custom instructions. Instead of relying on standard agent behavior, attackers replace the framework's persona file with specific directives that enable it to maintain access, collect sensitive information, and obey commands sent via Telegram. These commands are processed by a language model gateway, which translates the operator's intent into executable terminal commands.
The AI agent's primary targets are sensitive AI API keys, followed closely by SSH credentials, access tokens, and database access information. This focus on AI-related secrets mirrors a growing trend observed in recent AI ransomware campaigns, where attackers rapidly move from initial compromise to data exfiltration and system disruption by exploiting exposed services and stolen credentials. The distinction between the unchanged framework and the custom instructions is crucial, as it allows the botnet to operate maliciously without requiring the development of entirely new malicious software.
CARBONATO's propagation mechanism relies on automated scripts that continuously scan attached networks for exposed Docker daemons. Upon finding a new vulnerable server, the scripts repeat the deployment process, establishing a reverse SSH tunnel to a relay server, installing an SSH server with an attacker-controlled key, and sending deployment details to the operator via Telegram. The botnet also employs techniques to disguise its infected containers and processes as legitimate Linux activity, making detection more challenging during routine system reviews.
Persistence is achieved through various methods, including cron jobs, systemd timers, startup scripts, and OpenRC configurations, with associated files made difficult to alter. Watchdog mechanisms are in place to re-deploy the implant from the registry if it is removed, underscoring the persistent threat posed by exposed Docker environments. The botnet's registry also contained trojanized cryptocurrency wallet applications, further highlighting the diverse malicious intent behind the operation.
Defensive measures recommended by researchers include securing Docker daemon APIs by keeping them off public networks, implementing strong authentication for registries, and monitoring for unexpected privileged containers and unusual outbound Telegram traffic. Administrators should also inspect systems for non-standard persistence mechanisms, inventory and rotate AI API keys, and investigate specific indicators of compromise, such as the IP addresses and domains associated with the botnet's infrastructure.