CARBONATO MALWARE HIJACKS DOCKER HOSTS WITH AI AGENTS

Carbonato represents an escalating threat as attackers combine traditional botnet tactics with AI-powered frameworks. The malware identifies Docker hosts lacking proper security hardening and deploys the Hermes Agent—an AI framework that enables sophisticated automated control and operations on compromised systems. The attack chain exploits a common vulnerability: Docker daemons exposed to the internet without authentication or firewall restrictions. Once installed, Hermes Agent provides attackers with AI-driven capabilities to execute commands, manage resources, and potentially launch secondary attacks across networks. The emergence of Carbonato underscores the dual risk landscape: unpatched infrastructure combined with AI-enhanced attack capabilities. Security teams should prioritize restricting Docker daemon access, implementing authentication, and monitoring for suspicious container deployments. The malware highlights why containerized environments require the same security rigor as traditional infrastructure.