ThreatDown discloses CARBONATO botnet: using AI agents to control compromised Docker hosts

ThreatDown researchers discovered a Docker botnet named CARBONATO that compromises hosts by exploiting unauthenticated Docker daemons exposed on port 2375, then executes commands on the host through privileged containers. The implant installs the MIT-licensed open-source agent framework Hermes Agent as-is, only overwriting its SOUL.md personality file, using a 39-line prompt to turn the agent into a post-exploitation tool named GH0ST that receives operator tasks via Telegram. The prompt lists AI API keys as the highest-priority loot, ahead of SSH credentials, access tokens, and databases, and names 14 providers. The worm scans /24 subnets of adjacent networks every five minutes for exposed Docker daemons and can spread without operator intervention.