Threat Actors Deploy AI Agent-Based Botnet to Operate Within Infected Servers

CARBONATO is an emerging botnet that leverages exposed Docker environments to establish persistent access on compromised servers. What makes the operation particularly notable is its use of an AI-powered agent that enables attackers to interact with infected systems through Telegram, execute tasks remotely, and receive automated results.

The campaign targets Docker daemons that have been improperly exposed to the internet without authentication. Once access is gained, CARBONATO deploys a privileged container, escapes into the host environment, establishes persistence mechanisms, and begins scanning connected networks for additional vulnerable systems.

Researchers at ThreatDown uncovered the campaign after discovering an exposed Docker registry that had been publicly accessible since May 2026. Their investigation revealed a large infrastructure footprint, including 59 repositories, 234 image tags, 605 verified blobs, and approximately 4.3 GB of stored data spanning activity from October 2024 through August 2026.

According to findings shared with Cyber Security News (CSN), the campaign demonstrates how a single misconfigured Docker service can evolve into a broader infrastructure compromise, allowing attackers to move laterally across networks and maintain long-term access.

Unlike conventional botnets that rely solely on scripted commands, CARBONATO combines automated propagation with an AI-driven operator framework. While standard botnet components handle scanning and spread, the embedded AI agent can receive instructions, gather valuable credentials, and perform post-compromise activities on already infected systems.

AI Agent Deployed on Compromised Hosts

At the core of CARBONATO is the open-source Hermes Agent framework. Rather than modifying the framework itself, the threat actors customized its behavior by replacing its default persona configuration with a set of instructions directing it to maintain access, harvest sensitive data, and execute tasks received through Telegram.

When an operator submits a request, the task is routed through the group's language-model gateway. The AI interprets the command, generates terminal instructions, evaluates returned results, and determines follow-up actions. These commands are then executed directly on the compromised server, with outputs delivered back to operators through Telegram.

The malware prioritizes the theft of AI-related credentials, including API keys for popular AI services. Researchers found that these credentials are targeted even before traditional assets such as SSH keys, access tokens, databases, and administrative credentials.

This approach reflects a growing trend in cybercrime where AI infrastructure itself has become a valuable target. Compromised API keys can potentially provide attackers with access to AI platforms, development environments, and cloud resources.

Importantly, the malicious functionality does not stem from the Hermes framework itself. The abuse originates from attacker-supplied instructions loaded during startup, meaning the underlying software remains legitimate while being repurposed for malicious operations.

Researchers also observed that the threat actor's AI gateway advertised support for 12 language models but exposed access to 27 models through its interface. As a result, infected systems may serve as sources of both conventional credentials and valuable AI platform access.

Propagation Mechanism

CARBONATO actively searches for Docker servers that allow unauthenticated network connections.

Upon locating a vulnerable Docker daemon, the malware launches a privileged container with extensive access to the host's filesystem, processes, and networking stack. This elevated access enables the attackers to execute commands directly on the underlying server rather than remaining confined within the container environment.

During deployment, the malware:

• Establishes reverse SSH tunnels to attacker-controlled infrastructure.
• Installs SSH services and attacker-controlled authentication keys.
• Sends deployment and status information to Telegram.
• Masks malicious processes and container names to resemble legitimate Linux activity.
• Creates multiple persistence mechanisms to survive reboots and administrative intervention.

The malware leverages cron jobs, systemd timers, startup scripts, and OpenRC configurations to maintain access. Additionally, watchdog mechanisms can automatically reinstall the implant from the same registry if components are removed, ensuring continued persistence.

Automated Network Discovery

Every five minutes, CARBONATO performs reconnaissance across networks connected to the compromised host.

The malware inspects:

• Local subnet ranges
• Docker bridge networks
• Connected container environments
• Adjacent infrastructure

Each discovered /24 network range is scanned for additional Docker services that may be exposed without authentication. When a vulnerable target is identified, CARBONATO automatically deploys itself and repeats the infection cycle.

Researchers emphasized that this propagation process is performed by conventional scripts rather than the AI agent itself. The AI component is primarily reserved for post-compromise interaction and operational tasks.

Additional Findings

The exposed registry contained more than just botnet components. Researchers also identified trojanized cryptocurrency wallet applications stored alongside CARBONATO infrastructure.

Because image layers, configurations, and deployment artifacts were publicly accessible, investigators were able to reconstruct significant portions of the operation. The discovery highlights the dangers associated with improperly secured private container registries, where sensitive deployment information can unintentionally become available to both defenders and attackers.

Defensive Recommendations

Organizations should take immediate steps to reduce exposure by:

• Removing Docker daemon APIs from publicly accessible networks.
• Enforcing authentication and access controls on container registries.
• Monitoring for unexpected privileged containers.
• Investigating unauthorized Telegram communications originating from servers.
• Reviewing persistence mechanisms such as cron jobs and systemd timers.
• Auditing and rotating AI API keys, tokens, and cloud credentials.
• Monitoring for suspicious reverse SSH tunnels and outbound connections.

Researchers noted that linguistic indicators, build timestamps, Telegram account information, and reverse-tunnel infrastructure suggest a possible connection to actors operating from Costa Rica. However, these indicators are considered circumstantial and do not constitute definitive attribution.

For defenders, the most pressing concern is identifying and securing exposed Docker services before the botnet can gain a foothold and begin propagating across additional systems. The operation demonstrates how a simple Docker misconfiguration can quickly escalate into a persistent, AI-assisted compromise capable of spreading throughout an organization's infrastructure.