Carbonato malware runs an AI agent inside your Docker host

For years the worst case on an exposed Docker socket was a crypto miner. Now it is an agent with a shell. Carbonato malware hijacks unauthenticated Docker daemons, drops an AI agent framework on the host, and then waits for plain-language tasks over Telegram — which it turns into commands itself. The novel part is not how it gets in. It is what it does once the operator stops typing commands and starts typing instructions.

What actually happened

Researchers at ThreatDown documented the campaign this week. The entry point is old and boring: Docker daemon APIs listening on port 2375 with no authentication. Carbonato launches a privileged container to reach the host, installs an SSH server, opens a reverse SSH tunnel back to the operator's keys, and nails down persistence four ways — cron jobs, systemd timers, rc.local, and OpenRC hooks.

Then it installs the Hermes Agent framework with an agent persona the operators call GH0ST. Tasking arrives through a Telegram chat. The model reads the task, writes the terminal commands, reads the output, and decides the next step, with results posted back to the chat. Observed jobs include credential harvesting and arbitrary command execution. It also spreads on its own: every five minutes it scans for more exposed Docker daemons.

ThreatDown found an exposed operator registry holding 60 repositories and 4.3 GB of image data, with operational evidence stretching from October 2024 through August 2026. Attribution is thin — a possible Costa Rica-based operator, no link to a known threat cluster. Useful indicators: the GH0ST persona file on disk, a CARBONATO_API_KEY setting, unexpected Telegram traffic from a server, and reverse SSH tunnels heading toward AS262145.

Why an agentic payload matters for your business

Close port 2375. There is no version of this that is acceptable. The Docker daemon API over plain TCP with no TLS and no auth is remote root, full stop. Bind the daemon to a Unix socket, and if you genuinely need remote access use TLS client certificates or SSH context. Then confirm it from outside your network rather than trusting your firewall config file.

Your malware signatures assumed a fixed script. A traditional dropper does the same thing every time, so you can match on it. An agent decides at runtime, so two infections on two hosts produce different command sequences. The stable detection surface moves up a layer: a model API key in your environment, outbound calls to a model endpoint, a messaging API in your egress logs, an inference framework installed on a box that has no business doing inference. Alert on those, not on command strings.

Egress filtering is now a security control, not a nicety. Carbonato's command channel is Telegram and its brain is a hosted model API. Both are ordinary HTTPS to reputable domains, which is exactly why default-allow outbound traffic is expensive. We default production egress to deny and allowlist the handful of endpoints a service actually needs. It is annoying for a day and it kills entire malware families.

This is the commodity phase of agentic attack tooling. Operational evidence goes back to late 2024 and the operators left a registry open — this is not elite tradecraft. It is a working template that anyone can copy, and it is targeting the single most common container misconfiguration on the internet. Assume the next one is better packaged.

Sources: BleepingComputer, Docker daemon security documentation.