Artificial Intelligence · Cybersecurity
Carbonato botnet deploys Hermes Agent on Docker hosts
Researchers said Carbonato broke into Docker daemons exposed on port 2375, installed Hermes Agent on infected hosts, and used Telegram commands, persistence mechanisms and credential theft instructions to control them.
- ThreatDown said Carbonato targeted Docker daemons exposed on port 2375 and spread to other nearby hosts every five minutes.
- On each infected machine, it installed Hermes Agent and altered the agent's persona file so commands arrived through Telegram and credentials were collected.
- ThreatDown said it discovered the operation through an unauthenticated Docker registry accessible since May 2026, and the staged material included botnet details and a separate trojanised wallet campaign.
- The activity was not linked to a known actor, though the report said clues suggested operators in Costa Rica.
ThreatDown said Carbonato broke into Docker daemons that were left open on port 2375 and then moved into adjacent networks on a five-minute cycle. It installed Hermes Agent on each host and rewrote the agent's persona file so the system would take instructions over Telegram.
The malware used privileged containers to run commands on the underlying machine, set up persistence and remote access, and then scanned for more Docker daemons nearby. It also used reverse SSH tunnels, an SSH server carrying the operators' key, masquerading system files and watchdog-style restart scripts.
ThreatDown said it found the operation through a Docker registry that had been publicly reachable since May 2026. It said the staged data contained material about the botnet and about a separate campaign that spread trojanised cryptocurrency wallet apps, and it said language, timezone and infrastructure clues pointed to Costa Rica.
The article then moved to other reports on AI-assisted intrusions. Palo Alto Networks said knaithe and KnYuan were linked to a China-based campaign that used DeepSeek and Hermes Agent, Hunt.io said Hermes Agent had been used against Thailand's Ministry of Finance, Gambit Security said a Chinese-speaking operator had used Strix, Cairn and Hermes against online retailers, and Cisco Talos described CLOSEDQUORUM, a Windows implant that queried several models to decide what to do next.
Named in this story
Companies
- ThreatDown
- the security company that disclosed the operation
- Palo Alto Networks
- the company that linked knaithe and KnYuan to an AI-enabled campaign
- Hunt.io
- the company that highlighted the Thailand Ministry of Finance campaign
- Gambit Security
- the company that reported a retailer-focused AI-assisted operation
Organisations
- knaithe
- an alias for a China-based threat actor
- KnYuan
- another alias for the same China-based threat actor
- Cisco Talos
- the security team that described CLOSEDQUORUM as operator-configured
Governments and agencies
- Thailand's Ministry of Finance
- the government target in the Hermes Agent campaign
Products and systems
- Carbonato
- the botnet malware under discussion
- Hermes Agent
- the open-source AI agent framework installed on compromised hosts
- Docker
- the container platform whose exposed daemons were targeted
- Telegram
- the messaging platform used for operator commands and reporting
- Strix
- an AI penetration testing tool used in that operation
- Cairn
- an autonomous penetration testing engine used in that operation
- DeepSeek v4.1 Flash
- the model used by Cairn during the retail campaign
- Anthropic Claude Opus 4.6
- the model used by Hermes in the retail campaign
- CLOSEDQUORUM
- the Go-based Windows implant described later in the article
- Alibaba Qwen
- one of the models queried by CLOSEDQUORUM
- Mistral
- one of the models queried by CLOSEDQUORUM
- Google Gemini
- one of the models queried by CLOSEDQUORUM
Places
- Costa Rica
- the location indicated by infrastructure clues and the relay server
How the source tells it
The article was written in technical threat-intelligence prose with a mild alarmist edge and a strong focus on automation and novelty.
- alarm loaded malware naming and repeated references to persistence, credential theft and evasion
- urgency trend framing around growing AI use in attacks and references to recent campaigns
- novelty focus on Telegram-controlled AI agents and implants that query models to choose actions