A new botnet called Carbonato is hijacking exposed Docker hosts to install and reprogram AI agents. Researchers warn the malware deploys the Hermes framework, then overwrites its core instructions to obey remote attackers.
You know that feeling when you leave the back door unlocked? It's a small oversight, but it can lead to big trouble. That's essentially what's happening right now with some Docker hosts, and the consequences are more sophisticated than your typical break-in.
Cybersecurity researchers have pulled back the curtain on a new threat called the Carbonato botnet. It's not just stealing data or mining cryptocurrency. This malware is targeting exposed Docker daemons to deploy something far more interesting—and dangerous. It's installing an open-source artificial intelligence framework called Hermes Agent and then bending it to its will.
Think of Docker as a way to run applications in neat, isolated containers. But if the management port (the Docker daemon) is left open to the internet without proper security, it's like putting a welcome mat out for attackers. The Carbonato botnet is walking right in.
### What Makes This Attack Different?
Most botnets are blunt instruments. They flood networks or lock up files for ransom. Carbonato is different. It's precise. Once it finds a vulnerable Docker host, it doesn't just install junk. It carefully deploys the Hermes AI Agent framework completely unchanged at first. This is a legitimate tool developers use to create autonomous AI agents that can perform tasks.
The clever—and scary—part comes next. The malware overwrites a critical file called `SOUL.md`. This file acts as the AI's persona, its core instructions and ethical guidelines. The attackers replace it with their own 39-line prompt. This new "soul" reprograms the AI agent to take its marching orders from a remote command center, believed to be controlled through Telegram.
Suddenly, a powerful tool for automation becomes a remote-controlled digital soldier. We're not talking about a simple script anymore. We're talking about an AI that can reason, make decisions, and execute complex sequences.
### Why Should You Be Concerned?
If you're managing any cloud infrastructure, this should be a wake-up call. The initial entry point is a basic misconfiguration, something that happens all the time in fast-paced dev environments. The payload, however, is cutting-edge.
- **Stealthy Operations:** An AI agent can perform tasks that look more like legitimate user activity, making it harder for traditional security tools to spot.
- **Adaptability:** Unlike static malware, an AI framework can be dynamically re-tasked via simple text prompts from the attackers.
- **Resource Abuse:** These compromised hosts could be used for anything from data theft and fraud to launching further attacks, all under the guise of normal AI processing.
One researcher from ThreatDown put it bluntly: "The implant installs the framework unchanged, then overwrites its SOUL.md persona file. The 39-line prompt directs it to execute tasks received through the attacker's channel." It's a chillingly simple takeover.
### What Can You Do Right Now?
The good news is that the primary defense against this is straightforward security hygiene. It's about locking that digital back door.
First, audit your Docker deployments. Never, ever leave the Docker daemon API port (2375/tcp or 2376/tcp for TLS) exposed to the public internet without strong authentication and network controls. If you don't absolutely need it exposed, close it off. Use firewall rules to restrict access to only trusted IP addresses.
Second, keep everything updated. Ensure your Docker engine, host operating system, and all containers are running the latest patched versions. Many breaches exploit known vulnerabilities that have already been fixed.
Finally, monitor for unusual activity. Look for unexpected container creation, strange network connections from your Docker hosts, or processes consuming abnormal amounts of CPU or memory. The deployment of the Hermes framework would be a significant red flag.
This story of Carbonato and Hermes is a powerful reminder. In our rush to adopt powerful new technologies like AI and containerization, we can't forget the fundamentals. A single misconfigured port is all it takes to turn a tool for innovation into a weapon for attackers. It's a lesson in vigilance, one unlocked door at a time.
