CTI · reviewed · 2026-09-25

Carbonato malware uses AI agents to hijack exposed Docker hosts

Full story & timeline

Actors

—

Malware / tools

Carbonato

Campaigns

—

CVEs

—

Victim sectors

technologycryptocurrency

Geography

global

MITRE ATT&CK

T1610 Deploy Container Execution
T1609 Container Administration Command Execution
T1053 Scheduled Task/Job Execution
T1046 Network Service Discovery Discovery
T1102 Web Service Command and Control
T1572 Protocol Tunneling Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Connections to Unauthenticated Docker API Port 2375
id: 63350363-720a-440a-94d3-ebcc0aa1aa21
status: experimental
description: >
    Detects traffic to TCP 2375, the unauthenticated Docker API port
    the Carbonato botnet scans for every five minutes on attached
    networks and Docker bridges. Carbonato launches privileged
    containers with host mounts through this API, opens a reverse SSH
    tunnel, and installs persistence via cron, systemd timers and
    rc.local — no malware binary is needed on disk at first contact
    (ThreatDown, August 2026).
references:
    - https://www.threatdown.com/blog/carbonato/
    - https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
author: Tia N. List
date: 2026/09/25
tags:
    - attack.t1046
    - attack.t1610
logsource:
    category: network_connection
detection:
    selection_api_port:
        dst_port: 2375
    condition: selection_api_port
falsepositives:
    - Legitimate Docker daemons configured without TLS and reachable on the network
    - Internal health checks or management tooling polling the Docker API
level: medium

References

Source on GitHub