{"schema_version":"0.10.0","id":"LR-2026-0731","record_version":1,"title":"CARBONATO AI-driven botnet hijacks Docker hosts and steals credentials","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":62.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":5.44,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"3 independent outlets","original_document":null,"reports_total":3,"reports_independent":3,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"3 independent outlets"}]},"sources_hash":"e6b84a87d9ddb6b48360515a23ed50b022ce022547a199109a9502929e6a1df6"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":"privileged container with access to the host","autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"post-exploitation tool: maintain persistence and carry out Telegram commands","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2024-10-01","date_occurred_precision":"month","date_disclosed":"2026-09-24","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Carbonato is a Docker-based botnet, active since at least October 2024, that targets Docker daemons exposed on port 2375 without authentication. It launches a privileged container with access to the host, opens a reverse SSH tunnel, and installs the open-source Hermes Agent framework, which the operators reconfigure with a persona file named GH0ST. Operators send tasks through Telegram; the agent writes terminal commands, reads the output, and collects AI API keys, SSH credentials and access tokens. Scripts scan nearby networks every five minutes and spread the implant to other exposed hosts. ThreatDown found the operation after an unauthenticated container registry was exposed on the internet, and reported it in September 2026. The operators are likely based in Costa Rica, although attribution is not confirmed. The sources do not state the number of compromised hosts or any losses.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Docker daemon API on port 2375 exposed without authentication","failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","secondary_risks":["RK03"],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["J3","J2"],"quote":"To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":"Docker hosts with an API exposed on port 2375 without authentication","protected_class_involved":null,"data_categories_exposed":["AI API keys","SSH credentials","access tokens"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/","publisher":"BleepingComputer","date":"2026-09-24","type":"press","title":"New Carbonato malware uses AI agents to hijack exposed Docker hosts - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://securityaffairs.com/199716/malware/ai-powered-carbonato-botnet-steals-credentials-to-fund-its-own-llm-gateway.html","publisher":"Security Affairs","date":"2026-09-25","type":"press","title":"AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway - Security Affairs","archived_url":null,"independence":"independent"},{"url":"https://forkast.news/carbonato-is-the-first-botnet-where-the-command-and-control-engine-is-an-ai-agent-and-it-has-been-running-since-october-2024/","publisher":"Forkast News","date":"2026-09-27","type":"press","title":"CARBONATO Is the First Botnet Where the Command-and-Control Engine Is an AI Agent — and It Has Been Running Since October 2024 - Forkast News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.permissions_scope":"C","system.intended_use":"C","event.incident_class":"C","event.agent_involved":"C","event.date_occurred":"C","event.detection_method":"C","event.root_cause_detail":"C","impact.data_categories_exposed":"C","impact.affected_description":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.permissions_scope":[{"source_index":0,"quote":"The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host."}],"system.intended_use":[{"source_index":1,"quote":"GH0ST is told to act as a post-exploitation tool, maintain persistence, and carry out commands sent by the operators through Telegram."}],"event.incident_class":[{"source_index":0,"quote":"A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control."}],"event.agent_involved":[{"source_index":2,"quote":"CARBONATO is a Docker-based botnet that utilizes an autonomous AI agent as its command-and-control (C2) engine rather than a static server."}],"event.date_occurred":[{"source_index":1,"quote":"CARBONATO is a Docker-based botnet that has been active since at least October 2024."}],"event.detection_method":[{"source_index":1,"quote":"ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet."}],"event.root_cause_detail":[{"source_index":0,"quote":"According to ThreatDown, Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"In the case of Carbonato, Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back the results."}],"impact.affected_description":[{"source_index":0,"quote":"Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication."}],"impact.severity":[{"source_index":0,"quote":"The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes."}],"event.remediations":[{"source_index":0,"quote":"To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries."}],"event.summary":[{"source_index":1,"quote":"CARBONATO is a Docker-based botnet that has been active since at least October 2024."},{"source_index":0,"quote":"Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication."},{"source_index":0,"quote":"The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host."},{"source_index":0,"quote":"It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key, and reports the new deployment through Telegram."},{"source_index":0,"quote":"In the case of Carbonato, Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data, running commands, and sending back the results."},{"source_index":0,"quote":"The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes."},{"source_index":1,"quote":"ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet."},{"source_index":0,"quote":"ThreatDown could not attribute Carbonato to any known threat clusters, but based on various evidence, points to Costa Rica as a possible location of the operator."}]},"notes_on_gaps":"No model name, model version or LLM gateway model is stated; the gateway's underlying model is not named. Autonomy level, deployment context, lifecycle stage and guardrails are not stated and were left out. No direct loss, records count, or number of affected or compromised hosts is stated. Event.failure_class was left out because the sources describe an operator-directed loop rather than an autonomous agent failing. Date_disclosed uses the BleepingComputer publication date from the source header, as no sentence states a disclosure date. Date_occurred uses the earliest evidenced activity (October 2024) as a judgement; the incident start is not stated. Date_detected is month-level from Forkast; sources conflict only in framing. Responsible_party third_party and trigger human_misuse are judgements from the operator-driven description. Control E1 as missing is an inference from the privileged container giving host access; no source names sandboxing. Severity moderate is a judgement: victim hosts and credentials were touched but the affected count and bounded scope are not stated. Costa Rica is a possible operator location only and was not recorded as the incident country. Source 0 mention of an unrelated Gambit card-skimming case was excluded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (3 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Operators reconfigured the Hermes Agent framework with a persona called GH0ST, instructed to act as a post-exploitation tool and carry out Telegram commands.","quote":"GH0ST is told to act as a post-exploitation tool, maintain persistence, and carry out commands sent by the operators through Telegram.","source_index":1,"grade":"C"},{"step":"went_wrong","text":"Docker daemons exposed on port 2375 without authentication allowed the malware to launch a privileged container with access to the host.","quote":"The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host.","source_index":0,"grade":"C"},{"step":"reached","text":"Scripts scanned attached networks every five minutes and spread the implant to other exposed Docker daemons.","quote":"The malware’s worm-like capability allow it to spread to other exposed Docker daemons and is handled by scripts that scan networks attached to the host every five minutes.","source_index":0,"grade":"C"},{"step":"caught","text":"ThreatDown researchers found the operation after an unauthenticated container registry exposed on the internet was discovered.","quote":"ThreatDown discovered the operation after finding an unauthenticated container registry exposed to the internet.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/","https://securityaffairs.com/199716/malware/ai-powered-carbonato-botnet-steals-credentials-to-fund-its-own-llm-gateway.html","https://forkast.news/carbonato-is-the-first-botnet-where-the-command-and-control-engine-is-an-ai-agent-and-it-has-been-running-since-october-2024/"]},"analysis":{"sections":{"timeline":[{"text":"Botnet activity evidenced as active since at least October 2024.","quote":"CARBONATO is a Docker-based botnet that has been active since at least October 2024.","source_index":1,"when":"2024-10"},{"text":"Operational evidence retrieved by ThreatDown covers October 2024 to August 2026.","quote":"Researchers at enterprise security company ThreatDown retrieved operational evidence spanning October 2024 to August 2026.","source_index":0,"when":null},{"text":"ThreatDown researchers discovered the operation.","quote":"Discovered by ThreatDown researchers in August 2026, this is the first documented instance where the C2 infrastructure reasons through its environment to adapt to the specific configuration of each compromised host, moving beyond the hardcoded scripts typical of traditional botnets.","source_index":2,"when":"2026-08"},{"text":"The operators' LLM gateway was observed live, funded by stolen keys.","quote":"These stolen keys are used to power the operators’ own LLM gateway, which was observed live on September 3, 2026, advertising 12 models and serving 27 through its API on a free tier.","source_index":2,"when":"2026-09-03"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/","https://securityaffairs.com/199716/malware/ai-powered-carbonato-botnet-steals-credentials-to-fund-its-own-llm-gateway.html","https://forkast.news/carbonato-is-the-first-botnet-where-the-command-and-control-engine-is-an-ai-agent-and-it-has-been-running-since-october-2024/"]}}