Carbonato malware targets exposed Docker hosts

ThreatDown researchers at Malwarebytes said Carbonato was a botnet that targeted insecure Docker hosts. They said it connected to Docker APIs exposed on port 2375 without authentication and used them to start privileged containers.

The researchers said they recovered operational evidence from an unauthenticated Docker registry. The archive contained nearly 60 repositories, 4.3 GB of image data, and material dated from October 2024 to August 2026; it also held details about Carbonato and a separate campaign involving counterfeit cryptocurrency wallet apps.

After gaining access, the malware opened a reverse SSH tunnel, installed an SSH server with the operators’ key and sent deployment reports through Telegram. Scripts also set up cron jobs, systemd timers, rc.local entries and OpenRC hooks to keep it in place.

ThreatDown said Carbonato also installed Hermes Agent using an agent called GH0ST and instructions that replaced the default SOUL.md persona file. According to the researchers, Hermes handled tasks from Telegram, including collecting AI API keys, SSH credentials and access tokens, and it could spread to other exposed Docker daemons by scanning attached networks every five minutes.

The researchers said they could not attribute Carbonato to a known threat cluster. Based on the evidence, they pointed to Costa Rica as a possible location for the operator.