"Carbonato" Botnet Puts a Telegram-Controlled Hermes Agent on Hijacked Docker Hosts to Harvest AI API Keys

Hosts running Docker daemons exposed without authentication on port 2375

ThreatDown disclosed Carbonato on September 23, 2026 after finding the operators' own unauthenticated Docker registry, public since May 2026, holding nearly 60 repositories and 4.3 GB of staging data covering October 2024 to August 2026. The botnet launches a privileged container on each exposed daemon to run commands on the host, scans neighboring networks every five minutes for more targets, opens a reverse SSH tunnel to a relay in Costa Rica, and installs the Hermes Agent framework with an agent named "GH0ST" whose `SOUL.md` persona file is replaced by a 39-line prompt. The agent takes tasks over Telegram, collects AI API keys, SSH credentials, and access tokens, runs commands, maintains persistence, and reports back to the same chat. ThreatDown points to Costa Rica-based operators but could not tie them to a known group

Unauthenticated container daemons on the internet, now paired with an open-source agent that turns each foothold into an interactive operator taking natural-language orders