Ethical Hacking News
The CARBONATO botnet has been found to use AI-powered malware to steal credentials and fund its own LLM gateway. The operation appears to be linked to Costa Rica, with clues including timestamps, country codes, and Telegram handles. Experts warn of the risks of exposure and advise taking steps to protect against the botnet's tactics. With the ability to spread across networks without AI, the CARBONATO botnet poses a significant threat to cybersecurity.
The CARBONATO botnet uses AI and exploits Docker daemons to spread across networks and steal sensitive information. The botnet appears to be linked to Costa Rica, with evidence including image configurations and Telegram handle. The botnet uses an AI-powered framework called Hermes Agent to spread and steal information. The botnet's infrastructure is layered on through cron jobs, systemd timers, and other files, making it difficult to detect and clean up. Experts recommend not exposing Docker daemons to unauthenticated connections, locking down registries with authentication, and monitoring for abuse signatures.
The CARBONATO botnet has left cybersecurity experts stunned with its sophisticated tactics and use of artificial intelligence (AI) to carry out its malicious activities. The botnet, which has been active since at least October 2024, exploits Docker daemons to gain entry into vulnerable hosts, and then uses an AI-powered framework called Hermes Agent to spread across networks and steal sensitive information.
The operation appears to be linked to Costa Rica, although researchers say the infrastructure could also be used by someone operating from elsewhere. The initial infection method is relatively simple, as the bot scans for Docker daemons accepting unauthenticated connections on port 2375, a configuration that thousands of hosts still run publicly reachable.
Once infected, the bot installs an SSH server, adds the crew's own key, and sends a deployment report to a Telegram chat. A script opens a reverse SSH tunnel back to a relay in Costa Rica, installing an AI agent, and stealing API keys. The botnet spreads across networks without using AI, every five minutes, a script checks the networks connected to the compromised host and its Docker bridges, then scans the surrounding /24 networks for exposed Docker daemons on port 2375.
The part that makes CARBONATO genuinely new is what comes after persistence is established. The implant installs Hermes Agent, an MIT-licensed open-source framework from Nous Research, entirely unchanged. The attackers only modify one file: the agent's SOUL.md persona file, which renames the agent "GH0ST" and tells it what to do. The modified agent is harder to detect through the binary alone, as the instructions loaded when the agent starts are straightforward.
GH0ST is told to act as a post-exploitation tool, maintain persistence, and carry out commands sent by the operators through Telegram. The prompt lists 14 providers by name, including OpenAI, Anthropic, Google, and Gemini, and ranks those keys above SSH credentials, above access tokens, above databases. The reason becomes clear when you look at the operation's own LLM gateway, which was still live on September 3, running on a free tier while advertising 12 models and serving 27 through its API.
These operators are funding their own AI compute with stolen credentials from the machines they've already compromised. The actual workflow is a loop. An operator sends a task through Telegram. Hermes Agent forwards that task, along with the SOUL.md persona, to the LLM gateway. The model writes terminal commands, reads the output, decides what to do next, and reports back to the same Telegram chat that receives deployment notifications.
The botnet's infrastructure is layered on through cron jobs, systemd timers, rc.local, and OpenRC, and every one of those files gets marked immutable afterward so a cleanup attempt can't just delete them. A paired watchdog monitors the deployment and re-pulls the implant from the registry if its container disappears. The container itself runs under the name "systemd-resolved" and displays a fake systemd-networkd resolver banner, while its process arguments imitate a kernel thread called [kworker/u2:0].
Several clues point to Costa Rica. Fourteen of 162 image configurations contain UTC-06:00 timestamps matching the country's timezone. The operators also use the Telegram handle "Carbo506", while +506 is Costa Rica's country code. In addition, the reverse SSH tunnels connect to infrastructure in AS262145, a Costa Rican network. None of these clues would be enough on its own, but together they provide stronger evidence linking the operation to Costa Rica.
To protect against the CARBONATO botnet, experts recommend not exposing the daemon API to the network unauthenticated, and locking down every registry with authentication. They also advise not blocking Hermes Agent outright, but instead hunting for the abuse signature, which includes a /root/.hermes/SOUL.md containing "GH0ST", a .env file carrying CARBONATO_API_KEY, or unexplained Telegram traffic leaving the servers. If storing AI API keys, treat them the way this crew explicitly does: "The doctrine ranks them first, so inventory where they live, rotate them, and monitor their usage."
Related Information:
https://www.ethicalhackingnews.com/articles/Unveiling-the-CARBONATO-Botnet-A-Complex-Web-of-Malware-and-Artificial-Intelligence-ehn.shtml
https://securityaffairs.com/199716/malware/ai-powered-carbonato-botnet-steals-credentials-to-fund-its-own-llm-gateway.html
https://cyberpress.org/carbonato-botnet-hijacks-docker-hosts/
Published: Fri Sep 25 07:10:57 2026 by llama3.2 3B Q4_K_M
