Carbonato Botnet Leverages AI to Target Exposed Docker Hosts
On September 24, 2026, security researchers uncovered Carbonato, a new botnet malware that exploits exposed Docker daemons using an embedded AI agent framework for autonomous operation. The malware deploys Hermes Agent AI to seize control of compromised Docker hosts, marking a shift toward AI-driven malware capable of adaptive, self-directed behavior.
Carbonato specifically targets Docker daemons background services managing containerized environments left exposed to the internet without proper authentication. When unsecured, these daemons grant attackers direct access to container management APIs, enabling malicious container deployment, data exfiltration, or full host takeover. Unlike traditional botnets that rely on rigid, pre-programmed commands, Carbonato’s integration of Hermes Agent AI allows it to make autonomous decisions, such as identifying privilege escalation paths, evading defenses, or adapting to host configurations without manual intervention.
This AI-driven approach reduces the botnet’s dependence on centralized command-and-control (C2) infrastructure, making it more resilient to takedown efforts. Even if C2 communications are disrupted, the malware can continue operating independently, posing a persistent threat. The targeting of Docker hosts is particularly concerning, as compromised systems often run in high-bandwidth cloud environments, making them ideal for DDoS attacks, cryptocurrency mining, or further malicious infrastructure. Additionally, Docker hosts frequently store sensitive data, including API keys and database credentials, in environment variables or mounted volumes.
Organizations running Docker are advised to secure daemons by restricting internet exposure, enforcing TLS encryption, and implementing certificate-based authentication. Network firewalls should block access to default Docker ports (2375 for unencrypted, 2376 for TLS), and remote access should be routed through VPNs or bastion hosts. Exposed daemons should be treated as potentially compromised, requiring forensic investigation to detect Carbonato or other malware.
The emergence of Carbonato reflects a broader trend in malware development: the use of AI agent frameworks to create more sophisticated, autonomous threats. As open-source AI tools become more accessible, the line between traditional scripted malware and AI-enabled threats will continue to blur, demanding advanced defensive strategies to counter evolving attack methods.
Docker TPRM report: https://www.rankiteo.com/company/docker
Organizations running Docker TPRM report: https://www.rankiteo.com/company/docker
"id": "doc1790346274",
"linkid": "docker",
"type": "Cyber Attack",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': ['Cloud services', 'Technology', 'DevOps'],
'type': 'Organizations running Docker'}],
'attack_vector': 'Exposed Docker daemons (API access without authentication)',
'data_breach': {'data_exfiltration': 'Possible',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['API keys',
'Database credentials',
'Sensitive environment '
'variables']},
'date_detected': '2026-09-24',
'date_publicly_disclosed': '2026-09-24',
'description': 'Security researchers uncovered *Carbonato*, a new botnet '
'malware that exploits exposed Docker daemons using an '
'embedded AI agent framework for autonomous operation. The '
'malware deploys *Hermes Agent AI* to seize control of '
'compromised Docker hosts, marking a shift toward AI-driven '
'malware capable of adaptive, self-directed behavior.',
'impact': {'data_compromised': 'API keys, database credentials, sensitive '
'data in environment variables or mounted '
'volumes',
'operational_impact': 'Potential full host takeover, malicious '
'container deployment',
'systems_affected': 'Docker hosts in cloud environments'},
'initial_access_broker': {'entry_point': 'Exposed Docker daemons'},
'lessons_learned': 'The emergence of AI-driven malware like Carbonato '
'highlights the need for advanced defensive strategies to '
'counter evolving threats. Traditional security measures '
'may be insufficient against autonomous, adaptive malware.',
'motivation': ['DDoS attacks',
'Cryptocurrency mining',
'Data exfiltration',
'Malicious infrastructure'],
'post_incident_analysis': {'corrective_actions': ['Restrict Docker daemon '
'exposure',
'Implement TLS and '
'certificate-based '
'authentication',
'Block default Docker ports '
'via firewalls',
'Use VPNs or bastion hosts '
'for remote access'],
'root_causes': 'Unsecured Docker daemons exposed '
'to the internet without proper '
'authentication'},
'recommendations': ['Secure Docker daemons by restricting internet exposure',
'Enforce TLS encryption and certificate-based '
'authentication',
'Block access to default Docker ports (2375/2376) via '
'network firewalls',
'Route remote access through VPNs or bastion hosts',
'Treat exposed daemons as potentially compromised and '
'conduct forensic investigations'],
'references': [{'source': 'Security researchers'}],
'response': {'containment_measures': ['Restrict internet exposure of Docker '
'daemons',
'Enforce TLS encryption',
'Implement certificate-based '
'authentication'],
'remediation_measures': ['Block access to default Docker ports '
'(2375/2376) via network firewalls',
'Route remote access through VPNs or '
'bastion hosts',
'Forensic investigation of exposed '
'daemons']},
'title': 'Carbonato Botnet Leverages AI to Target Exposed Docker Hosts',
'type': 'Botnet',
'vulnerability_exploited': 'Unsecured Docker daemons (default ports 2375/2376 '
'exposed to the internet)'}