Carbonato malware targets Docker hosts with exposed, unauthenticated Docker daemon APIs (port 2375). It exploits this to launch privileged containers, gaining host access, then installs the Hermes Agent AI framework with the GH0ST agent. This agent operates interactively via Telegram, executing commands, collecting credentials, and exfiltrating data. The malware establishes persistence using cron jobs, systemd timers, rc.local, and OpenRC hooks. It has worm-like capabilities, scanning attached networks every five minutes to propagate to other vulnerable Docker hosts. Operational evidence spans from October 2024 to August 2026. The malware's operator-driven AI agent interprets tasks, runs commands on victims, and reports results back through Telegram. Indicators include the GH0ST persona file and reverse SSH tunnels to AS262145. Researchers recommend disabling exposed Docker APIs and enforcing authentication to prevent infection.

Successful exploitation allows attackers to gain privileged access to Docker hosts, install a persistent AI-driven agent capable of executing arbitrary commands, stealing credentials and tokens, and maintaining remote control via reverse SSH tunnels. The worm-like propagation enables rapid spread across networks with exposed Docker daemons, potentially compromising multiple hosts. The AI agent's interactive command loop facilitates dynamic attacker control and data exfiltration, increasing operational flexibility and stealth.

To prevent Carbonato infection, ensure Docker daemon APIs are not exposed on the network and require authentication on Docker registries. These measures effectively block the primary infection vector. Monitor for indicators such as the GH0ST persona file, the CARBONATO_API_KEY environment variable, unexpected Telegram traffic, and reverse SSH tunnels. No official patch is indicated; securing Docker API exposure is the primary defense.