Redbot Labs / Threat Intelligence
CARBONATO Botnet Deploys Hermes AI Agent on Compromised Docker Hosts
- Incident ID
- RBT-TI-0097
- Organization
- Unnamed Organizations Operating Exposed Docker Hosts
- Reported Location
- Costa Rica - Suspected Operator Location; Victim Locations Undisclosed
- Severity
- High
- Category
- AI-Enabled Post-Compromise Operations / Botnet / Credential Theft
- Record Date
- 2026-09-22
Incident Summary
AI-enabled host control. ThreatDown identified CARBONATO, a botnet that installs Hermes Agent on compromised Docker hosts for operator-directed post-compromise tasks.
What Happened
Initial compromise. Conventional scripts abuse unauthenticated Docker daemons, establish persistence, and spread.
Agent deployment. The implant installs the legitimate Hermes framework and replaces its persona with malicious GH0ST instructions.
Interactive operations. Operators submit tasks through Telegram. The model generates commands, interprets results, and selects subsequent actions. AI does not perform the botnet’s initial infection or propagation.
Affected Systems
Unauthenticated Docker Daemons / Linux Hosts / Locally Accessible Credentials
Attack Vector
Exposed Docker API / Privileged Container Abuse / AI-Assisted Post-Exploitation
Business Impact
Persistent access. Compromised hosts provide remote execution and credential-collection opportunities.
Scope limits. ThreatDown documents operational infrastructure and infected-host activity, but does not establish a public victim count or quantified losses.
The findings above come from ThreatDown’s recovered infrastructure and technical analysis.
Redbot Analysis
AI expands what attackers can do after access. Redbot Labs assesses that installing an agent on a compromised host can reduce the manual effort needed to investigate the environment and execute follow-on tasks. Operators can supply objectives while the agent handles intermediate decisions.
Infrastructure exposure remains a critical starting point. Organizations should validate Docker management access, container privileges, and host isolation alongside their AI controls. An agent does not need to defeat a model safeguard when it already operates inside an attacker-controlled environment.
Protect credentials as reusable access. Secrets available to a compromised workload may enable activity elsewhere. Credential isolation, narrowly scoped permissions, usage monitoring, and rapid revocation help contain that risk.
Investigate behavior and context. A legitimate agent framework can support both authorized work and malicious operations. Detection should examine how it was installed, its effective permissions, its instructions, and the actions it performs.
