AI-Powered Botnet CARBONATO Targets Exposed Docker Servers to Harvest AI API Keys
Security researchers uncovered CARBONATO, an advanced botnet operation that hijacks exposed Docker servers to prioritize the theft of AI API keys from providers like OpenAI, Anthropic, and Google. The campaign, active from October 2024 to August 2026, was discovered through an unauthenticated Docker registry publicly accessible since May 2026, containing 59 repositories, 234 image tags, and 4.3 GB of data.
How the Attack Works
CARBONATO scans for Docker daemons with unauthenticated access on port 2375, deploying a privileged container that mounts the host’s filesystem and network. The implant establishes persistence via cron, systemd, rc.local, and OpenRC, ensuring survival across reboots. It also:
- Opens a reverse SSH tunnel for operator access.
- Installs an SSH server and adds attacker-controlled keys.
- Sends Telegram deployment reports with host details (IP, country, container ID).
- Mimics legitimate processes (e.g., naming its container systemd-resolved).
AI-Driven Command & Control
The botnet leverages Hermes Agent, an open-source framework, by replacing its persona file with a 39-line prompt dubbed GH0ST. This AI-driven agent:
- Executes tasks via Telegram commands, processed through an LLM gateway.
- Prioritizes AI API key extraction over SSH credentials, tokens, or databases.
- Proposes and executes terminal commands interactively, though it does not autonomously spread.
Lateral Movement & Expansion
Every five minutes, the botnet scans attached networks and Docker bridges for additional exposed Docker APIs, deploying the implant to new hosts. While AI API keys are the stated priority, researchers note that not all compromised servers necessarily contained them.
Indicators of Compromise (IoCs)
- C2 IPs:
45[.]79[.]183[.]6191[.]99[.]195[.]164(linked to earlier fsociety-era infrastructure)
The operation also distributed trojanized cryptocurrency wallet apps in a separate but related campaign. Security teams are advised to monitor for unauthorized Docker API access and the presence of the identified IoCs.
Source: https://cyberpress.org/ai-botnet-hijacks-docker-servers/
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
Google Cloud Security cybersecurity rating report: https://www.rankiteo.com/company/googlecloudsecurity
OpenAI cybersecurity rating report: https://www.rankiteo.com/company/openai
"id": "ANTGOOOPE1790576637",
"linkid": "anthropicresearch, googlecloudsecurity, openai",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Various (technology, AI, cloud services, '
'etc.)',
'location': 'Global (targets with exposed Docker APIs)',
'type': 'Organizations with exposed Docker servers'}],
'attack_vector': 'Exposed Docker daemons (unauthenticated access on port '
'2375)',
'data_breach': {'data_exfiltration': 'Yes (via Telegram deployment reports '
'and LLM gateway)',
'sensitivity_of_data': 'High (AI API keys, PII potential)',
'type_of_data_compromised': 'AI API keys, SSH credentials, '
'tokens, databases, '
'cryptocurrency wallet data '
'(related campaign)'},
'date_detected': '2024-10-01',
'date_publicly_disclosed': '2026-08-01',
'description': 'Security researchers uncovered CARBONATO, an advanced botnet '
'operation that hijacks exposed Docker servers to prioritize '
'the theft of AI API keys from providers like OpenAI, '
'Anthropic, and Google. The campaign leverages an AI-driven '
'agent (GH0ST) to execute tasks via Telegram commands, '
'focusing on lateral movement and persistence within '
'compromised networks.',
'impact': {'data_compromised': 'AI API keys (OpenAI, Anthropic, Google), SSH '
'credentials, tokens, databases, '
'cryptocurrency wallet data (related campaign)',
'identity_theft_risk': 'High (if AI API keys or PII were exposed)',
'operational_impact': 'Unauthorized access, persistence '
'mechanisms, reverse SSH tunnels, lateral '
'movement',
'systems_affected': 'Exposed Docker servers, attached networks, '
'Docker bridges'},
'initial_access_broker': {'backdoors_established': 'Reverse SSH tunnels, SSH '
'server installation, '
'cron/systemd persistence',
'entry_point': 'Exposed Docker daemons (port 2375)',
'high_value_targets': 'AI API keys, SSH '
'credentials, tokens, '
'databases'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Exposed Docker APIs are high-value targets for AI-focused '
'botnets. Persistence mechanisms (cron, systemd) and '
'lateral movement via Docker bridges increase attack '
'surface. AI-driven C2 frameworks (e.g., Hermes Agent) '
'enable dynamic command execution.',
'motivation': 'Financial gain (AI API key theft), potential resale on dark '
'web, cryptocurrency theft (related campaign)',
'post_incident_analysis': {'corrective_actions': 'Disable unauthenticated '
'Docker API access, '
'implement authentication, '
'segment Docker networks, '
'deploy IoC monitoring.',
'root_causes': 'Unauthenticated Docker API access, '
'lack of network segmentation, weak '
'monitoring for Docker-related '
'threats.'},
'recommendations': ['Secure Docker daemons with authentication and network '
'restrictions (e.g., disable port 2375 exposure).',
'Monitor for unauthorized Docker API access and IoCs '
'(e.g., C2 IPs: 45[.]79[.]183[.]61, 91[.]99[.]195[.]164).',
'Implement network segmentation to limit lateral '
'movement.',
'Audit AI API key storage and rotate exposed keys '
'immediately.',
'Deploy enhanced monitoring for reverse SSH tunnels and '
'Telegram-based C2 traffic.'],
'references': [{'date_accessed': '2026-08-01',
'source': 'Security Research Report'}],
'response': {'enhanced_monitoring': 'Monitor for unauthorized Docker API '
'access and IoCs (e.g., C2 IPs)'},
'threat_actor': 'Unknown (CARBONATO operators)',
'title': 'AI-Powered Botnet CARBONATO Targets Exposed Docker Servers to '
'Harvest AI API Keys',
'type': 'Botnet, Data Theft, AI API Key Harvesting',
'vulnerability_exploited': 'Unauthenticated Docker API access'}