The Carbonato botnet has been active for nearly two years, targeting Docker hosts with open, unauthenticated APIs on port 2375. Researchers at ThreatDown identified that the malware gains host access by deploying privileged containers. It then establishes persistence through SSH tunnels, cron jobs, and systemd timers.
A key component of the attack is the Hermes Agent framework, specifically an agent named GH0ST. This AI-powered tool interprets tasks, executes terminal commands, and exfiltrates data such as SSH credentials and API keys. The malware communicates with its operators via Telegram, which serves as a primary command-and-control channel.
Carbonato functions as a worm, with scripts scanning connected networks every five minutes to identify and infect additional Docker services. The malware was initially discovered in an unofficial Docker registry containing nearly 60 repositories and 4.3 GB of image data.
While the operators remain unidentified, researchers linked the activity to an internet service provider in Costa Rica, specifically AS262145. Experts recommend securing Docker APIs with authentication and restricting network access to prevent further compromises.
