Full Report
A new botnet malware called Carbonato is targeting insecure hosts running Docker daemons to install the Hermes Agent AI framework and take control. [...]
Analysis Summary
# Tool/Technique: Carbonato Botnet & Hermes Agent (GH0ST)
## Overview
Carbonato is a sophisticated botnet malware designed to compromise insecure Docker daemons. It leverages worm-like propagation to spread across networks and installs the **Hermes Agent AI framework** (configured with a persona named "GH0ST") to automate post-exploitation tasks, data exfiltration, and command execution via an interactive AI-driven loop.
## Technical Details
- **Type:** Malware family / Botnet
- **Platform:** Linux (Docker/Container environments)
- **Capabilities:** Worm-like propagation, AI-driven command execution, credential harvesting, persistence, and reverse SSH tunneling.
- **First Seen:** Evidence of operations spans October 2024 to August 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application] (Targeting unauthenticated Docker APIs on port 2375)
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Cron]
- [T1543.002 - Create or Modify System Process: Systemd Service]
- [T1037.004 - Boot or Logon Initialization Scripts: RC Scripts]
- **[TA0004 - Privilege Escalation]**
- [T1610 - Deploy Container] (Launching privileged containers to gain host access)
- **[TA0005 - Defense Evasion]**
- [T1611 - Escape to Host]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning] (Automated scanning for other Docker daemons every 5 minutes)
- **[TA0009 - Collection]**
- [T1552 - Unsecured Credentials] (Collecting SSH keys, API keys, and access tokens)
- **[TA0011 - Command and Control]**
- [T1571 - Non-Standard Port]
- [T1572 - Protocol Tunneling] (Reverse SSH tunnels)
- [T1102 - Web Service] (Telegram API for C2 reporting and tasking)
## Functionality
### Core Capabilities
- **Worm Propagation:** Automated scripts scan attached networks every five minutes to identify and infect other exposed Docker APIs.
- **Privileged Container Deployment:** Upon discovery, the malware pulls an implant from a rogue registry and launches a privileged container to break out to the host system.
- **Persistence Multi-Vector:** Utilizes `cron`, `systemd` timers, `rc.local`, and `OpenRC` hooks to ensure the infection survives reboots.
- **C2 Integration:** Uses Telegram to report new deployments and receive tasks from operators.
### Advanced Features
- **AI-Driven Post-Exploitation:** Integrates the **Hermes Agent** framework with a custom "GH0ST" persona. The AI agent interprets high-level tasks, generates terminal commands, executes them on the victim, and analyzes the output to decide subsequent actions autonomously.
- **Reverse SSH Tunneling:** Establishes persistent remote access tunnels to circumvent firewalls.
- **Credential Harvesting:** Specifically targets AI API keys, SSH credentials, and cloud access tokens.
## Indicators of Compromise
- **File Names:**
- `SOUL.md` (Overwritten with GH0ST persona instructions)
- **Network Indicators:**
- Port `2375/tcp` (Targeting insecure Docker API)
- Traffic to/from Telegram API domains (`api.telegram[.]org`)
- Reverse SSH tunnels targeting `AS262145`
- **Behavioral Indicators:**
- Creation of unexpected privileged Docker containers.
- Automated outbound scanning on local network segments every 5 minutes.
- Environment variables such as `CARBONATO_API_KEY`.
## Associated Threat Actors
- **Unknown Cluster:** Current research suggests a possible link to operators based in **Costa Rica**, though formal attribution to a known group has not been established.
## Detection Methods
- **Signature-based detection:** Monitoring for the "GH0ST" persona strings within `SOUL.md` files or Carbonato-specific scripts in `/etc/` or `systemd` directories.
- **Behavioral detection:**
- Detecting unauthorized Docker API calls on port 2375.
- Monitoring for the creation of privileged containers from unknown registries.
- Identifying suspicious long-lived SSH processes (tunnels) connecting to anomalous ASNs.
- **Environment Audit:** Check for the presence of the `CARBONATO_API_KEY` environment variable.
## Mitigation Strategies
- **Docker Hardening:** Never expose the Docker daemon API (`2375`) to the public internet. Use TLS/SSL for authentication if the API must be accessible over the network.
- **Registry Security:** Require strict authentication for all container registries and block access to unauthorized or public unauthenticated registries.
- **Network Segmentation:** Restrict container network access to prevent lateral movement (worm propagation).
- **Access Control:** Implement the principle of least privilege; avoid running containers in `--privileged` mode unless strictly necessary.
## Related Tools/Techniques
- **Hermes Agent:** An open-source AI agent framework frequently abused for automated cyberattacks.
- **DeepSeek AI:** Used by similar campaigns to automate server attacks.
- **Kinsing / TeamTNT:** Other botnet groups known for targeting Docker/Kubernetes environments for cryptojacking and resource hijacking.