Carbonato Botnet Installs an AI Agent on Every Docker Host It Hijacks

An open Docker socket used to be a server breach. Now it also comes with a robot.

ThreatDown disclosed Carbonato on 24 September, a botnet that spreads by finding Docker hosts with the daemon API exposed on port 2375, no password, no TLS. The exposed port itself is old news; that same misconfiguration has been owning servers since 2015. What the researchers found inside the operation is the new part, and it should keep any hosting operator up at night: on every hijacked host, the attackers install an AI agent framework and hand it the keys to the machine.

The agent runs under the persona name “GH0ST” and takes its orders through Telegram. ThreatDown recovered operational evidence spanning October 2024 to August 2026 from an open Docker registry holding nearly 60 repositories and 4.3 GB of images. According to their writeup, the model reads a task, writes terminal commands, reads the output, and decides what to do next without help. It hunts AI API keys, SSH credentials, and access tokens, then reports back to the same Telegram chat that receives deployment notices.

How the kill chain works

The mechanics are simple once a daemon answers on 2375 without authentication:

• The malware calls the Docker API and instructs the daemon to launch a privileged container, which hands it the host.
• It opens a reverse SSH tunnel and installs an SSH server carrying the operator’s key.
• Persistence goes in through cron jobs, systemd timers, rc.local, and OpenRC hooks, so killing one process changes nothing.
• Every five minutes, worm scripts scan the host’s networks for the next exposed daemon, pull the implant from the registry, and start the loop again.

One exposed dev box on a flat network can reinfect an entire estate on its own, every five minutes, whether anyone is watching or not.

Why the AI-agent layer changes the math

A traditional botnet operator has to babysit thousands of shells. Carbonato offloads that to a model running on the victim. Each box stops being a script execution and becomes a conversation. This is the same agent framework Gambit recently linked to a skimming ring that stole around 600,000 credit card numbers, so the abuse pattern is not isolated.

For African fintechs and enterprises running containers on cloud VPCs or colo racks, the lesson is narrow and hard. Your perimeter audit probably already covers the obvious ports. Port 2375 usually hides on an internal interface that security never sees, because the host team spun it up for convenience on a Tuesday and everyone forgot.

What to check today

1. Inventory every system answering on TCP 2375 or 2376. If it answers from anywhere but localhost, treat it as compromised until proven otherwise.
2. Look for the Carbonato signatures ThreatDown published: a GH0ST persona file, a CARBONATO_API_KEY environment setting, Telegram traffic from a server that has no business running a chat client, and reverse SSH tunnels toward AS262145.
3. Bind the Docker daemon to a local socket only, and require authentication on any registry you actually need online.
4. Audit outbound SSH from container hosts. A reverse tunnel from a server that should never dial out is the loudest signal you will get.

ThreatDown could not pin Carbonato to a known crime cluster, though the evidence points to an operator possibly based in Costa Rica. That ambiguity is the problem. This is malware built as a self-contained, self-driving toolkit, and nothing stops the next copy from showing up in Johannesburg or Lagos hosting ranges.

Where eHawu fits

Carbonato is a network-layer problem, and the AI part only matters because the network let it in the door. eHawu’s zero-trust fabric authenticates every workload before it can speak, which means an unauthenticated Docker API never answers to anyone off-box. Default-deny east-west traffic kills the five-minute worm scan at the first hop, and continuous device identity flags the reverse SSH tunnel before the operator ever sees a shell. If your container estate was built for speed and not for verification, this is the gap agent-driven botnets are being shipped to walk through.