A Docker-based botnet called CARBONATO plants an AI agent on compromised hosts and points it at one prize above all others, AI provider API keys.
The trail started with a mistake on the operators’ side. ThreatDown found the campaign by chance, after locating a container registry left open to the internet without authentication. A day of passive, read-only collection yielded 4.3GB of images spanning 59 repositories. Worse for the operators, the image history exposed command-and-control addresses, bot tokens and the shared password to their own AI gateway.
Getting in takes little effort. Thousands of Docker daemons worldwide accept commands from anyone, with no authentication at all. The bot finds one and, through the daemon’s own API, spins up a privileged container that mounts the host filesystem. From there it issues commands directly on the machine. Traffic returns through a reverse SSH tunnel to a Costa Rican relay, and the tunnel port is computed from the target’s IP address rather than stored. Persistence then lands through cron jobs, systemd timers and startup scripts, each flagged immutable so a cleanup attempt cannot simply delete them. To a passing process listing, the container looks like a system resolver and a kernel worker thread.
The novel part comes next. The implant installs Hermes Agent, an open-source AI framework, unchanged, then overwrites its persona file with a 39-line prompt that renames the agent GH0ST and points it at Telegram-delivered tasks. The prompt ranks keys from 14 providers ahead of SSH credentials and database logins. Operators were funding their own model access with credentials stolen from the machines they had already owned.
The fix is familiar advice: never expose your Docker daemon without authentication, and rotate AI keys.
