CARBONATO: First AI‑Agent‑Driven Botnet Hijacking Docker Hosts

CARBONATO is a Docker‑based botnet first observed in October 2024 that uses an autonomous LLM‑powered AI agent (Hermes) as its command‑and‑control engine. The botnet spreads by exploiting unauthenticated Docker daemon APIs and pushing malicious images to public, unauthenticated container registries. Once installed, Hermes steals API keys, cloud tokens, and SSH credentials, which are then used to pay for external LLM API calls, financing the botnet’s own AI‑driven C2. This self‑funding, adaptive C2 model enables persistent, evasive operations across global cloud and on‑premise Docker hosts.

• Overview & Infection Vector
• First seen Oct 2024; remained undetected until Aug 2026 when ThreatDown researchers uncovered it.
• Infection occurs via unauthenticated Docker daemon RPC (TCP 2375) and public container registries lacking authentication.

• Deploys Docker images containing the Hermes AI agent, exploit scripts, and persistence mechanisms.

• AI Agent (Hermes) C2 Mechanics

• Hermes is an LLM‑based autonomous module that reasons about the compromised host’s environment.
• Generates real‑time, context‑aware commands, adapting tactics to evade defenses.

• Communicates with an external LLM gateway using stolen API credits for decision‑making and command synthesis.

• Credential Theft & Self‑Funding Model

• Steals API keys, cloud service tokens (AWS, Azure, GCP), and SSH credentials from compromised hosts.
• Credentials are used directly to pay for LLM API usage (e.g., OpenAI, Anthropic) or sold on underground markets.

• Revenue funds continued operation of the Hermes agent and finances botnet expansion.

• Propagation & Persistence Techniques

• Pushes new malicious container images to compromised registries for lateral spread across environments.
• Includes a self‑update routine that pulls newer versions of its codebase from the registry.

• Leverages exposed Docker sockets to run privileged containers without authentication, ensuring persistence.

• Detection Challenges & Mitigations

• Dynamic, AI‑generated command language defeats static signature‑based detection and traditional sinkholing.
• Lack of fixed C2 infrastructure complicates takedown and threat‑intel sharing.

• Recommended controls: disable unauthenticated Docker API, enforce image signing and registry authentication, monitor registry pushes for unknown images, detect anomalous outbound LLM API calls, apply least‑privilege container runtime profiles.

• Conclusion

• CARBONATO marks the first documented botnet employing an AI agent as its C2, signaling a shift toward adaptive, self‑financing malware.
• Highlights the critical risk of exposed container orchestration interfaces and the weaponization of legitimate LLM services.
• Urges organizations to audit Docker exposure, enforce strict API authentication, and implement telemetry for anomalous LLM usage.