Reported by 2 outlets
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.57 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CARBONATO is a Docker-focused botnet tracked since August 2026 that repurposes the open-source Hermes Agent framework as an interactive post-compromise layer. It targets exposed Docker daemons on TCP port 2375, spreads via worm-like propagation, establishes persistence through cron and systemd timers, opens reverse SSH tunnels, and delivers reports through Telegram. The implant names its container systemd-resolved to blend in and prioritizes AI API keys ahead of other stolen credentials. K7 Labs and threat researchers documented 59 repositories, 234 image tags, and 4.3 GB of archive data spanning October 2024 to August 2026, with evidence of a parallel operation distributing trojanized cryptocurrency wallet apps. No CVEs are assigned to the botnet itself; the risk is unauthenticated Docker exposure combined with automated post-exploitation control.
Defenders should audit Docker daemon authentication, restrict port 2375 exposure, and review container runtime telemetry for unexpected privileged containers named like system services. The Telegram-driven AI control layer indicates operator interaction rather than fully autonomous behavior, but the worm-like spread makes exposed hosts vulnerable to rapid compromise.
Timeline
-
original reporting
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
gbhackers.com · 15d ago · September 28th, 2026
A Docker-focused botnet that repurposes the legitimate, open-source Hermes Agent framework as an interactive post-compromise control layer. The campaign, tracked as CARBONATO, targets Docker daemons exposed without authentication on TCP port 2375, then combines worm-like propagation, stealthy persistence, reverse SSH access and Telegram-driven AI-agent operations. The investigation began in August 2026 after researchers identified a […] The post Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
AI-Powered Botnet Hijacks Exposed Docker Servers and Steals API Keys
cyberpress.org · 15d ago · September 28th, 2026
The botnet’s instructions put AI API keys ahead of other credentials, while separate scripts handle its spread across reachable hosts. Researchers found the operation through an unauthenticated Docker registry that had been publicly exposed since May 2026. In one day of read-only collection, they recovered 59 repositories, 234 image tags and 4.3 GB of image data. The archive, spanning October 2024 to August 2026, also documented a separate operation distributing trojanized cryptocurrency wallet apps. When it finds one, it uses the Docker API to start a privileged container with the host filesystem mounted and access to the host’s process and network namespaces. This lets the implant run commands on the underlying server. AI Botnet Hijacks Docker Servers The implant then opens a reverse SSH tunnel for operator access, installs an SSH server and adds the operators’ key. It sends a deployment report through Telegram containing the host’s name, IP address, country and container ID. To survive reboots or cleanup, it creates persistence hooks through cron, systemd timers, rc.local and OpenRC. Watchdogs can pull the implant again if its files or container disappear. entry.sh v5.3, tier 1: the foothold, the deterministic tunnel port, and the Telegram deployment repor (Source: threatdown) CARBONATO also tries to blend in. Its container is named systemd-resolved , and its