Carbonato Malware Installs AI Agents on Exposed Docker Hosts

Carbonato malware targets Docker hosts that expose their management API without authentication. Once inside, it installs an AI agent that helps operators run commands and collect credentials, according to researchers at ThreatDown.

Exposed Docker APIs Give Carbonato Access

Carbonato looks for Docker daemons with an unauthenticated API exposed on port 2375. It connects to the API and tells Docker to start a privileged container, which gives the malware access to the underlying host.

The malware then opens a reverse SSH tunnel and installs an SSH server with the operators’ key. It reports each new deployment through Telegram. To survive restarts, it also sets up scheduled tasks and startup hooks.

ThreatDown discovered the malware in an unauthenticated Docker registry containing nearly 60 repositories and 4.3 GB of image data. The researchers found operational material dating from October 2024 to August 2026.

AI Agent Carries Out Operator Commands

On compromised hosts, Carbonato installs the Hermes Agent framework and configures an agent named GH0ST. Its instructions replace the framework’s default persona file.

Operators send tasks through Telegram. The agent interprets those requests, runs terminal commands, reads the results and reports back. ThreatDown describes this as an interactive process directed by the operators.

The tasks can include gathering AI API keys, SSH credentials and access tokens. The agent can also run other commands on the compromised machine.

Malware Searches for More Docker Hosts

Carbonato malware has worm-like spreading capabilities. Every five minutes, its scripts scan networks connected to an infected host for other exposed Docker daemons.

When the malware finds another vulnerable host, it pulls the implant from the registry and launches a privileged container. It then establishes persistence and begins scanning from the newly compromised system.

ThreatDown has not linked Carbonato to a known threat group. Some evidence points to Costa Rica as a possible location for an operator, but the researchers have not confirmed an attribution.

Administrators Should Check Docker Exposure

ThreatDown recommends keeping Docker daemon APIs off exposed networks and requiring authentication for registries.

Possible signs of infection include a GH0ST persona file, a CARBONATO_API_KEY setting, unexpected Telegram traffic and reverse SSH tunnels to infrastructure identified in the researchers’ report.