A newly discovered Docker botnet is implanting AI agents onto compromised hosts in order to send stolen credentials back to the attackers.
ThreatDown researchers recently uncovered Carbonato, a botnet that compromises servers running unauthenticated Docker daemons (the background process that manages Docker containers, images, networks, and related operations) exposed on port 2375, establishes persistence, and spreads to other reachable Docker hosts.
Researchers discovered the botnet last month when they identified an unauthenticated Docker registry that had been publicly exposed since May. This was attacker-controlled infrastructure tied to two seemingly separate operations: a factory distributing Trojanized cryptocurrency wallet apps and the Carbonato botnet.
Across one day of passive, read-only data collection, ThreatDown identified "59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of image data" tied to attacker activity, according to a blog post.
How the Carbonato Botnet Gets its Hooks In
During an attack, the threat actor first identifies an exposed Docker host on Port 2375. Then the Carbonato botnet sends instructions to the unauthenticated service telling it to launch a privileged container with access to the host machine's file system, processes, and network. Once connection is established, the attacker installs an implant capable of persistent remote access (via an SSH reverse tunnel), attempts to disguise itself, and installs an AI agent that executes commands from an attacker-controlled Telegram chat.
The agent is based on Hermes Agent, an open source agent framework from Nous Research that is licensed under the MIT License. This is perhaps the most novel aspect of the botnet. Embedded on the compromised Docker host is the basic framework as well as a 39-line prompt directing the agent to "execute tasks received through Telegram, maintain persistence, and collect credentials," the researchers said.
The agent's primary goal, ThreatDown assessed, is to collect AI API keys first and foremost, prioritizing them ahead of other data such as access tokens, SSH keys, and databases. Separately from the agent, the botnet malware includes more conventional scripts (i.e., not AI-driven) that search nearby networks for other exposed Docker services, compromise additional hosts, and repeat the infection cycle.