Carbonato represents a fundamental shift in how infrastructure attacks operate: rather than simply commandeering Docker hosts for computational power, the malware deploys the Hermes Agent AI framework to create an autonomous, operator-guided system that extracts credentials, executes commands, and spreads itself across networks with minimal human intervention. The attack chain is methodical—exploiting unauthenticated Docker APIs on port 2375, launching privileged containers, establishing persistence through multiple mechanisms (cron jobs, systemd timers, rc.local hooks), and then installing a customised AI agent named "GH0ST" that receives instructions via Telegram and interprets them into executable terminal commands. ThreatDown's analysis of operational evidence spanning October 2024 to August 2026 reveals this isn't theoretical; the malware has been actively compromising hosts for nearly two years, with the worm-like scanning capability allowing it to propagate across entire network segments every five minutes. The discovery of 60 repositories and 4.3 GB of image data in an unauthenticated registry suggests scale and sophistication that points toward a coordinated operation rather than opportunistic exploitation.
For CX teams, the implications cut across infrastructure security and data exposure. If your organisation runs containerised customer data systems—whether for Zendesk integrations, API orchestration, or backend services—exposed Docker daemons become direct pathways to customer records, API keys, and authentication tokens. The Hermes Agent's ability to autonomously collect "AI API keys, SSH credentials, access tokens, and other data" means that even if you're not running AI agents yourself, attackers can weaponise them to extract the credentials your team relies on. The question becomes urgent: how many CX platforms and integrations are running on Docker infrastructure without proper network segmentation or authentication controls? The persistence mechanisms Carbonato deploys—particularly the reverse SSH tunnels and cron-based callbacks—suggest attackers maintain long-term access, creating windows for credential harvesting that could compromise customer data long after initial infection.
The broader concern is that this attack pattern normalises AI agents as attack infrastructure rather than defensive tools. Hermes Agent has been documented in multiple malicious campaigns, including large-scale card-skimming operations that compromised 600,000 credit card details. For CX professionals evaluating AI-powered solutions—whether customer-facing agents or backend automation—the Carbonato case demonstrates that the same frameworks enabling legitimate automation can be repurposed for credential theft and lateral movement. The operator-driven "interactive command loop" that allows attackers to task the AI agent in real time transforms compromised infrastructure into a managed asset rather than a static backdoor. Organisations should audit Docker deployments immediately, enforce authentication on all registries and daemon APIs, and treat any unexpected Telegram traffic or reverse SSH tunnels toward AS262145 as indicators of active compromise.
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]