Carbonato botnet targeting exposed Docker daemons with Hermes Agent
Malware Activity
Summary
Hide ▲
Show ▼
Carbonato is a botnet malware that targets Docker daemons exposed on port 2375 without authentication to install Hermes Agent and keep control of infected hosts. ThreatDown/Malwarebytes said the operation pulls implants from an unauthenticated Docker registry, overwrites SOUL.md with a GH0ST persona, and uses Telegram, reverse SSH tunnels, and persistence hooks to run operator commands and collect credentials. The activity is tied to evidence spanning October 2024 to August 2026, with indicators including CARBONATO_API_KEY and reverse SSH tunnels toward AS262145.
Related Happenings
TuxBot v3 Evolution IoT botnet framework with brute-force and exploit modules
Malware Activity
H score28
First: 15.07.2026 21:43
Last: 15.07.2026 21:43
Sources 1
About this happening:
The newly disclosed TuxBot v3 Evolution IoT botnet framework expands attacker control with DDoS, proxy, and persistence capabilities, increasing the risk to co...
TuxBot v3 Evolution IoT botnet framework with brute-force and exploit modules
Malware ActivityAbout this happening: The newly disclosed TuxBot v3 Evolution IoT botnet framework expands attacker control with DDoS, proxy, and persistence capabilities, increasing the risk to co...
AUDIOFIX and MiniRAT macOS malware activity
Malware Activity
H score34
First: 28.05.2026 10:54
Last: 28.05.2026 10:54
Sources 1
About this happening:
The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
AUDIOFIX and MiniRAT macOS malware activity
Malware ActivityAbout this happening: The AUDIOFIX and MiniRAT malware activity is targeting cryptocurrency firms and developer infrastructure on macOS with LinkedIn recruiter lures, a fake mee...
SHub Reaper macOS infostealer variant
Malware Activity
H score23
First: 19.05.2026 00:42
Last: 19.05.2026 00:42
Sources 1
About this happening:
The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
SHub Reaper macOS infostealer variant
Malware ActivityAbout this happening: The SHub Reaper macOS infostealer now uses AppleScript and a fake Apple security update lure to infect Macs, raising the risk of credential theft and remote access. It...
Timeline
-
24.09.2026 23:10 3 articles · 13d ago
Carbonato botnet targets exposed Docker daemons to install Hermes Agent
Initial DisclosureThreatDown/Malwarebytes reports Carbonato, a botnet malware targeting insecure Docker hosts exposed on port 2375 without authentication, where it pulls implants from an unauthenticated Docker registry, launches privileged containers, installs Hermes Agent with the GH0ST persona and SOUL.md overwrite instructions, and uses reverse SSH tunnels, Telegram reporting, and persistence hooks to retain host control. Researchers say operational evidence spans October 2024 to August 2026 and includes indicators such as CARBONATO_API_KEY, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.
Show sources
- New Carbonato malware uses AI agents to hijack exposed Docker hosts — www.bleepingcomputer.com — 24.09.2026 23:10
- New Carbonato malware uses AI agents to hijack exposed Docker hosts — www.bleepingcomputer.com — 24.09.2026 23:10
- Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent — thehackernews.com — 28.09.2026 14:46