Executive Summary
In September 2026, ThreatDown researchers discovered the Carbonato botnet, a sophisticated attack campaign targeting exposed Docker hosts through unauthenticated daemons on port 2375. The botnet deploys AI agents based on the open-source Hermes Agent framework to execute commands via Telegram and prioritize theft of AI API keys alongside traditional credentials. The attackers establish persistence through SSH reverse tunnels and spread laterally to compromise additional Docker hosts, with evidence suggesting operators based in Costa Rica. The campaign highlights the intersection of AI-powered automation with traditional botnet infrastructure, creating new challenges for detection and response.
This incident represents a significant evolution in botnet operations, demonstrating how threat actors are weaponizing AI frameworks to enhance their attack capabilities. As organizations increasingly rely on containerized environments and AI services, this attack pattern signals a new threat landscape where autonomous AI agents can be embedded within compromised infrastructure to conduct persistent credential harvesting operations.
Why This Matters Now
The Carbonato botnet represents the first documented case of attackers deploying AI agents within botnet infrastructure to automate credential theft, particularly targeting high-value AI API keys as organizations rapidly adopt AI services without adequate security controls.
Attack Path Analysis
The Carbonato botnet exploits exposed Docker daemons on port 2375 to deploy privileged containers, establishes persistence via SSH reverse tunnels, spreads laterally to additional Docker hosts, deploys AI agents for command execution via Telegram, and exfiltrates AI API keys and credentials. The attack leverages unauthenticated Docker services for initial access and uses automated scripts for propagation across networked infrastructure.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scan for and compromise exposed Docker daemons running on port 2375 without authentication, sending instructions to launch privileged containers with host system access
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Deploy Container
Scheduled Task/Job: Cron
Protocol Tunneling
Unsecured Credentials: Credentials In Files
Remote System Discovery
Lateral Tool Transfer
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Network Asset Management
Control ID: ID.AM-2
PCI DSS 4.0 – Configuration Standards for System Components
Control ID: 2.2.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
DORA – Identification and Classification of ICT Risk
Control ID: Article 8
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21.2
ISO 27001:2022 – Access to Networks and Network Services
Control ID: A.9.1.2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Docker containerization infrastructure targeted by AI-enabled botnet threatens core development operations, requiring enhanced container security and API key management protocols.
Computer Software/Engineering
Carbonato botnet specifically targets exposed Docker daemons used in software development, compromising CI/CD pipelines and stealing valuable AI API credentials.
Financial Services
Docker-based fintech applications vulnerable to AI agent infiltration and credential theft, with PCI compliance requirements demanding immediate container security reinforcement.
Health Care / Life Sciences
Healthcare Docker deployments face AI-powered lateral movement threats, requiring HIPAA-compliant segmentation and enhanced monitoring of containerized patient data systems.
Sources
- Carbonato Botnet Puts an AI Agent on Hacked Docker Hostshttps://www.darkreading.com/identity-access-management-security/carbonato-botnet-ai-agent-hacked-docker-hostsVerified
- Docker Daemon Attack Surfacehttps://docs.docker.com/engine/security/#docker-daemon-attack-surfaceVerified
- Hermes Agent - Open Source AI Frameworkhttps://github.com/NousResearch/Hermes-Function-CallingVerified
- CISA Docker Security Recommendationshttps://www.cisa.gov/news-events/cybersecurity-advisoriesVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain the Carbonato botnet's lateral movement and privilege escalation by implementing workload segmentation and east-west traffic controls. The attack's reliance on exposed Docker services and network propagation would face significant restrictions under zero trust architecture.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Container deployment and access to Docker APIs would likely be restricted through identity-aware controls, reducing the attack surface of unauthenticated daemon exploitation
Control: Zero Trust Segmentation
Mitigation: Container-to-host privilege escalation would likely be constrained through workload isolation policies that limit container access to host system resources and critical processes
Control: East-West Traffic Security
Mitigation: Network scanning and propagation to additional Docker hosts would likely be restricted through microsegmentation policies that control inter-workload communication paths
Control: Multicloud Visibility & Control
Mitigation: External communication channels and reverse tunnel establishment would likely be detected and constrained through comprehensive traffic monitoring and anomaly detection across cloud environments
Control: Egress Security & Policy Enforcement
Mitigation: Unauthorized data exfiltration and credential transmission would likely be constrained through controlled egress policies that restrict outbound data flows and monitor sensitive information transfers
The blast radius of compromised infrastructure would likely be significantly reduced, with segmentation policies limiting the botnet's ability to leverage infected nodes for widespread attacks
Impact at a Glance
Affected Business Functions
- Container Infrastructure Operations
- DevOps and CI/CD Pipelines
- Cloud Application Deployment
- API Key Management Systems
Estimated downtime: 3 days
Estimated loss: $25,000
AI API keys, SSH keys, access tokens, database credentials, and potentially sensitive data accessible through compromised Docker containers. The botnet specifically targets AI API keys as priority credentials, which could lead to unauthorized AI service usage and associated costs.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to prevent privileged container access to host systems and limit lateral movement between Docker hosts
- • Deploy egress security controls with FQDN filtering to detect and block unauthorized communications to Telegram channels and external C2 infrastructure
- • Enable multicloud visibility and anomaly detection to identify suspicious container deployments and automated scanning behaviors across networked infrastructure
- • Establish Kubernetes security controls with pod-to-pod segmentation and namespace enforcement to contain container breakout attempts
- • Implement threat detection capabilities to identify AI agent deployment patterns, credential harvesting activities, and reverse tunnel establishment
