A botnet called Carbonato is targeting Docker daemons exposed without authentication, installing the open-source Hermes Agent framework and turning it into a Telegram-controlled command layer, according to a report from The Hacker News citing ThreatDown. The operation reportedly uses compromised hosts to execute commands, maintain access and search for credentials, including AI API keys.
How the intrusion works
Carbonato scans for Docker services exposed on port 2375 and can spread to other hosts with the same configuration. After finding a target, it launches a privileged container capable of running commands on the underlying system. ThreatDown said the malware also scans nearby networks every five minutes, giving the campaign worm-like propagation capabilities.
The attack installs a shell script that creates a reverse SSH tunnel to a relay in Costa Rica, adds an SSH server with an operator-controlled key and sends deployment details through Telegram. Cron jobs and watchdog scripts help relaunch the malicious components if they are removed, while the implant disguises itself as a system component.
Repurposing an AI agent
The Hermes Agent installation is reportedly left intact except for its SOUL.md persona file. Carbonato replaces that file with instructions for the agent to act as an unrestricted offensive operator, receive tasks over Telegram and preserve access to compromised systems.
Incoming tasks are passed to an LLM gateway. The model produces terminal commands, Hermes executes them, and the results are returned to the attacker through Telegram. This setup makes the AI framework an orchestration interface inside the intrusion rather than the initial mechanism used to compromise Docker.
Broader use of automated attacks
The operators have not been linked to a known threat group. The report says language, timezone and infrastructure clues point toward Costa Rica, but that assessment remains attribution evidence rather than a confirmed identity.
The disclosure follows other reported campaigns using Hermes Agent and related AI tools for reconnaissance, exploitation and post-compromise activity. The Hacker News also described separate findings involving AI-assisted attacks on government systems and online retailers, as well as CLOSEDQUORUM, a Windows implant that consults multiple LLM providers before choosing predefined actions such as credential theft, injection and persistence.
The exposed service is the weakness
Carbonato's reported entry point is an unauthenticated Docker daemon, while Hermes Agent provides the later command-and-control workflow. The combination shows how an exposed container-management interface can give attackers both privileged execution and a flexible way to automate follow-on actions. The source does not establish how widely Carbonato has spread or identify confirmed victims.
AI-generated editorial illustration; not a documentary photograph.
Source: Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
SIGNAL TITANS
Leave a Reply