Executive Summary
The Carbonato botnet malware campaign, active from October 2024 to August 2026, targeted exposed Docker daemon APIs on port 2375 to deploy AI-powered attack frameworks. Attackers used the malware to install the Hermes Agent AI framework with a custom 'GH0ST' persona, enabling autonomous command execution, credential theft, and lateral movement across containerized environments. The operation utilized Telegram for command and control while establishing persistent backdoors through SSH tunnels and system service modifications across compromised Docker hosts.
This incident highlights the emerging threat of AI-augmented malware that can autonomously adapt attack strategies and execute complex multi-stage operations without constant human oversight, representing a significant evolution in automated cyber threats.
Why This Matters Now
AI-powered malware like Carbonato represents a paradigm shift where autonomous agents can execute sophisticated attacks, adapt tactics in real-time, and operate with minimal human intervention, dramatically increasing the scale and speed of cyber operations targeting cloud infrastructure.
Attack Path Analysis
Carbonato malware exploits exposed Docker daemon APIs on port 2375 without authentication, deploys privileged containers to gain host access, establishes persistence via SSH tunnels and system services, installs Hermes AI Agent framework for autonomous command execution via Telegram, spreads laterally through network scanning, and maintains ongoing operations for credential harvesting and system compromise.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scan for exposed Docker daemon APIs on port 2375 without authentication and deploy privileged containers to gain initial host access
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Deploy Container
Scheduled Task/Job: Cron
Protocol Tunneling
Impair Defenses: Disable or Modify Tools
Unsecured Credentials: Credentials In Files
Web Service
Remote System Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Non-consumer users and services authentication
Control ID: Requirement 2.2.7
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: Section 500.15
DORA – Identification and protection of critical or important functions
Control ID: Article 8
CISA ZTMM 2.0 – Microsegmentation and Network Isolation
Control ID: Network and Environment
NIS2 Directive – Cybersecurity risk-management measures
Control ID: Article 21
ISO 27001:2022 – Configuration management
Control ID: A.8.9
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Docker containerization infrastructure critically exposed to AI-powered botnet attacks targeting unauthenticated APIs, enabling automated credential theft and lateral movement across cloud environments.
Financial Services
Banking systems face heightened risk from Carbonato's AI agent capabilities targeting API keys and access tokens, with compliance violations across PCI and encrypted traffic requirements.
Health Care / Life Sciences
Healthcare Docker deployments vulnerable to AI-automated privilege escalation and data exfiltration, threatening HIPAA compliance through compromised segmentation and encryption controls.
Computer Software/Engineering
Software development environments exposed through containerized CI/CD pipelines, with AI agents automating discovery of SSH credentials and deployment tokens for persistent access.
Sources
- New Carbonato malware uses AI agents to hijack exposed Docker hostshttps://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/Verified
- Carbonato: AI-Powered Botnet Targets Docker Hostshttps://www.threatdown.com/blog/carbonato/Verified
- Hermes AI agent used to automate attack on Thai Finance Ministryhttps://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/Verified
- Malicious AI agents steal 600k credit cards, infect 100+ sites with skimmershttps://www.bleepingcomputer.com/news/security/malicious-ai-agents-steal-600k-credit-cards-infect-100-plus-sites-with-skimmers/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain the Carbonato malware's lateral spread and reduce blast radius through workload segmentation and east-west traffic controls. The framework's identity-aware routing and controlled egress policies could limit the scope of compromise across exposed Docker environments.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Container workload segmentation policies would likely limit the privileged container's ability to access host resources and restrict lateral communication pathways from the compromised Docker daemon
Control: Zero Trust Segmentation
Mitigation: Host-level segmentation policies would likely restrict the compromised container's ability to establish unauthorized SSH services and limit system-level persistence mechanisms to isolated network segments
Control: East-West Traffic Security
Mitigation: Network segmentation controls would likely constrain the malware's ability to scan across network boundaries and reduce reachability to additional Docker daemon endpoints during lateral propagation attempts
Control: Multicloud Visibility & Control
Mitigation: Cross-cloud traffic monitoring and control policies would likely detect and constrain unauthorized C2 communications, reducing the AI agent's ability to maintain persistent command channels across cloud environments
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely restrict the AI agent's ability to exfiltrate sensitive credentials and constrain data transmission pathways to unauthorized external Telegram endpoints
Residual botnet operations would likely be constrained to isolated network segments with limited access to additional infrastructure, reducing the overall scope of cryptocurrency mining and exploitation capabilities
Impact at a Glance
Affected Business Functions
- Container Orchestration
- Cloud Infrastructure Management
- Development and Deployment Pipelines
- Data Processing Services
Estimated downtime: 7 days
Estimated loss: $250,000
Compromise of SSH credentials, API keys, access tokens, and potential exposure of containerized application data. AI agent framework enables automated credential theft and lateral movement across Docker infrastructure.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to prevent unauthorized access to Docker daemon APIs and enforce identity-based policies for container orchestration platforms
- • Deploy egress security controls to block unauthorized Telegram traffic and prevent AI agent C2 communications to external command servers
- • Enable multicloud visibility and anomaly detection to identify suspicious automation patterns, repeated API calls, and unauthorized container deployments
- • Strengthen Kubernetes security with namespace enforcement and pod-to-pod segmentation to contain container breakout attempts
- • Deploy inline threat detection to identify and block malicious payload delivery and exploit traffic targeting container infrastructure
