MalwarePublished 24 Sep 2026Updated 24 Oct 2026

CARBONATO: a botnet built around an AI agent

Source AlienVault OTX General

Description

CARBONATO is a Docker botnet discovered by ThreatDown researchers that targets exposed Docker daemons on port 2375. It operates by distributing trojanized cryptocurrency wallet applications and running a botnet infrastructure. The botnet uses a modified Hermes Agent, an open-source AI framework, to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers and has been active from October 2024 through August 2026. No CVE identifiers or official patches are associated with this threat. The severity is medium due to credential theft and botnet control capabilities.

Impact

The botnet compromises Docker hosts with exposed daemons, enabling attackers to steal credentials and execute unauthorized commands via Telegram. The distribution of trojanized cryptocurrency wallets increases the risk of financial theft. Persistence mechanisms and credential harvesting capabilities allow prolonged unauthorized access and potential lateral movement within affected environments. The medium severity rating reflects these combined risks. No direct exploit code or CVEs are associated with this threat, and no known exploits in the wild have been reported.

Defensive guidance

Organizations should ensure Docker daemons are not exposed on public or untrusted networks, especially on port 2375, which is known to be insecure when unauthenticated. Access to Docker APIs should be restricted using authentication and network controls. Monitoring for unauthorized Docker registry access and suspicious network activity involving Telegram command execution is recommended. Follow best practices to secure Docker environments and remove any unauthorized containers or agents.

Indicators of compromise

IP addresses 5

213.136.79.115
213.136.79.115CC=DE ASN=AS51167 contabo gmbh
190.211.124.187
190.211.124.187CC=CR ASN=AS262145 cooperativa de electrificacin rural de san carlos r.l. (coopelesca r.l.)
91.99.195.164CC=IR ASN=AS16322 pars online pjs

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Oct 2026, 07:09 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

IP addresses 5

Community reviews

Related threats