{
 "public_id": "AIR-2026-0263",
 "incident_id": "2026-09-threatdown-carbonato-hermes-docker-botnet",
 "date_disclosed": "2026-09-22",
 "date_occurred": null,
 "title": "CARBONATO botnet turns exposed Docker hosts into Telegram-controlled Hermes Agent nodes",
 "class": "in_the_wild",
 "attack_surface": "autonomous_ops",
 "initial_vector": "unauthenticated_docker_api_port_2375",
 "agent_capability_abused": [
  "terminal_command_execution",
  "telegram_tasking",
  "credential_collection",
  "persistence"
 ],
 "target_product": "Hermes Agent (open-source agent framework, abused); exposed Docker daemons",
 "target_vendor": "Nous Research (framework); Docker host operators",
 "autonomy_level": "semi_autonomous",
 "impact_realized": false,
 "impact_type": [
  "host_compromise",
  "credential_theft"
 ],
 "blast_radius": "Docker daemons exposed on port 2375; network-propagating; victim count not stated",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI03",
   "ASI08"
  ],
  "mitre_atlas": [],
  "labels": [
   "botnet",
   "persona_file_overwrite",
   "ai_api_key_theft",
   "worm_propagation",
   "criminal_infrastructure"
  ]
 },
 "defense_present": null,
 "defense_bypassed": true,
 "fix_shipped": null,
 "primary_sources": [
  "https://www.threatdown.com/blog/carbonato/",
  "https://thehackernews.com/2026/09/carbonato-botnet-compromises-docker.html"
 ],
 "verified_quote": "The implant installs the framework unchanged, then overwrites its SOUL.md persona file. The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials.",
 "confidence": "high",
 "notes": "ThreatDown's own post (dated 22 September) is the primary source; The Hacker News coverage followed on 28 September. ThreatDown found the operation through an unauthenticated container registry that exposed the crew's toolchain, covering October 2024 to August 2026. Kept separate from AIR-2026-0175 and AIR-2026-0194: those are actors using Hermes as an autonomous offensive operator against chosen targets, whereas this is a self-propagating criminal botnet that installs stock Hermes Agent on hijacked hosts as a Telegram-driven operator interface, run by a different, apparently Costa Rica-linked crew. The agent here acts on operator instructions, hence semi-autonomous. ThreatDown prioritises AI API key theft in the persona prompt but does not report a count of compromised hosts or confirmed victim losses from its read-only registry analysis, so realized impact is not coded.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Credential & Secret Theft",
 "risk_sub_secondary": [
  "Remote Code Execution & Sandbox Escape",
  "Persistence & Covert C2",
  "Multi-agent contagion"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "operators drive an installed Hermes Agent over Telegram on hijacked hosts; contested because the agent is the botnet's interface and no victim action is documented",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "unauthenticated_docker_api_port_2375",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "openai",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "credential_theft",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "subcategory: Credential & Secret Theft",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (eai_category=credential_theft); ASI08 (signal=cascade)",
 "submitted_by": "EAI Internal"
}