Carbonato: a botnet that hands the controls to an AI agent

A new botnet is being run by an AI agent. ThreatDown's researchers found Carbonato while scanning the internet for exposed Docker services, and their report, published on 22 September, is the clearest look yet at a criminal operation that has put an off-the-shelf language model in the operator's chair rather than using one to write better phishing emails.

The registry that gave it away

The trail begins with a Docker registry on a US server that had been exposed to the internet since May and answered read-only requests without asking anyone for credentials. In a single day of passive collection the researchers recovered 59 repositories, 234 image tags, 605 cryptographically verified blobs and 4.3GB of image data, along with configuration files holding the operation's command-and-control addresses, bot tokens and the password shared by its language-model gateway. Image timestamps run from October 2024 to August 2026, and the archive covers two businesses: a factory for counterfeit cryptocurrency wallet apps, and the botnet.

How it takes a host

Carbonato hunts for Docker daemons that accept unauthenticated connections on port 2375. Finding one, it asks that daemon to launch a privileged container with the host filesystem mounted, then reaches back out through the Docker exec API to run commands on the host itself. From there a script called entry.sh opens a reverse SSH tunnel to a relay in Costa Rica, with the remote port derived from an MD5 hash of the victim's own IP address so the crew can recalculate it whenever it wants back in. It installs an SSH server, adds the operators' key, and sends a deployment report carrying the container ID, hostname, IP address and country to Telegram, written in the voseo Spanish used across parts of Central and South America.

That foothold is designed to survive being noticed. The implant runs in a container named systemd-resolved and prints a fake systemd-networkd resolver banner, while its process arguments imitate the kernel thread [kworker/u2:0]. Persistence hooks go into cron, systemd timers, rc.local and OpenRC, each marked immutable, and paired watchdogs re-pull the implant from the registry if its files or container disappear. An open registry is both the leak and the resupply line.

Then it installs an agent

With the host held, the implant installs Hermes Agent, an MIT-licensed open-source agent framework from Nous Research, and leaves the code alone. What it replaces is the agent's SOUL.md persona file, overwritten with a 39-line prompt that names the agent GH0ST, tells it that it is a post-exploitation tool rather than an assistant, forbids moralising, and ranks loot. The prompt puts API keys for large language models at the top of that list, above SSH credentials, access tokens and databases, and instructs the agent to store them in plaintext under /root/.hermes/loot/ and to report any exposed AI endpoints it finds.

The agent then works as an interface. An operator sends a task over Telegram; the framework forwards it, with the persona attached, to the operation's own LLM gateway, which ran on a free tier while advertising 12 models and serving 27 through its API. The model writes terminal commands, reads what comes back and decides what to do next, returning its report to the same chat that receives deployment notices. ThreatDown notes that target selection, persistence and spreading all happen in plain scripts, so the model handles only the interactive work an operator would otherwise sit and babysit.

It spreads itself

Every five minutes each infected host lists the networks attached to it and to its Docker bridges, then sweeps each /24 for daemons on port 2375, skipping any host it has already taken. A new victim pulls the implant from the same registry and joins the scan loop, which lets the botnet expand across a network without an operator issuing another task. In that phase there is no model involved at all.

Who is behind it

ThreatDown's attribution points towards Costa Rica, and it presents the case as an assessment rather than a finding. The deployment reports use voseo Spanish, 14 of 162 image configurations carry UTC-06:00 timestamps matching the America/Costa_Rica timezone, the Telegram handle ends in 506, which is the country's calling code, and the reverse tunnels terminate at a sink inside AS262145. Three separate parts of the operation - build configuration, operator identity and live infrastructure - point the same way.

What defenders should do

The infection vector is an exposed API, so the first fix is boring and complete: never publish the Docker daemon socket to the network, and require authentication on every registry. ThreatDown then makes a point worth repeating - do not blocklist the agent framework, because it is a legitimate package with ordinary users, and hunting a name will not find this. What does find it is the abuse signature: a SOUL.md file containing GH0ST, an environment file carrying CARBONATO_API_KEY, Telegram egress from a server that should have no reason to talk to Telegram, a watchdog at /usr/local/bin/.docker-network-monitor, a cryptocurrency miner pretending to be /usr/sbin/systemd-logind, and immutable bits on files nobody deliberately locked. The last recommendation is the one most teams will need to schedule: treat AI API keys like bank credentials, know where they live, rotate them, and watch how they are used.

Our opinion

Every security story this year arrives with a sentence about AI doing the hacking, and this one is more specific and stranger than that framing. Read the report properly and the model is not the clever part. Target selection is a port scan, persistence is a handful of shell scripts and the spreading is a cron job; what the crew actually outsourced was the sitting and watching, the tedious middle of an intrusion where someone has to read output and decide the next command. That is a labour story dressed as a technology story.

The detail that deserves more attention is the loot list. ThreatDown recovered a prompt that ranks OpenAI, Anthropic, Google, OpenRouter and Groq keys above SSH credentials, access tokens and databases, and it is difficult to argue with the economics. A stolen SSH key gets an attacker into one network that is probably being watched. A stolen model key gets spent quietly on someone else's account, often through an endpoint that was never in the threat model, and a surprising number of organisations still treat those keys as a developer convenience rather than a credential. If you take one action from this report, count your AI keys and find out who would notice if one of them started spending.

There is a lesson in the framework advice too. ThreatDown explicitly tells defenders not to blocklist the tool, because the abuse is the persona file and the key-harvesting instructions sitting on top of it, not the software underneath. Security teams that reach for the simplest name-based rule will be chasing a package with legitimate users while the actual signature sits unread in a file called SOUL.md. Attackers have moved on from writing their own frameworks; the sensible response is to stop reading signatures off brand names.