Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Summary: ThreatDown researchers disclosed a botnet called Carbonato that breaks into Docker daemons exposed without authentication on port 2375, launches a privileged container to run commands on the host, and installs the open-source Hermes Agent framework with its SOUL.md persona file overwritten by a 39-line prompt directing it to execute tasks received through Telegram, maintain persistence, and collect credentials. The implant opens a reverse SSH tunnel to a relay in Costa Rica, installs an SSH server with the operators' key, and uses cron jobs and watchdog scripts to relaunch itself if removed, while scanning neighboring networks every five minutes to spread to other unauthenticated Docker daemons.
What you should know: The persona instructs the agent to act as a "senior hacker, pentester, and exploit developer" named GH0ST without "moral or ethical restrictions," and names AI API keys and other credentials as its priority - so an exposed Docker port now buys an attacker an autonomous agent that hunts your keys and spreads itself every five minutes.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026