In the wild
CARBONATO botnet turns exposed Docker hosts into Telegram-controlled Hermes Agent nodes
AIR-2026-0263 AIR record · 2026-09-threatdown-carbonato-hermes-docker-botnet
From the supporting source
The implant installs the framework unchanged, then overwrites its SOUL.md persona file. The 39-line prompt directs it to execute tasks received through Telegram, maintain persistence, and collect credentials.threatdown.com
The record
Disclosed
2026-09-22
Vendor
Nous Research (framework); Docker host operators
Product
Hermes Agent (open-source agent framework, abused); exposed Docker daemons
Risk domain
Access control and permissions › Credential theft
System type
Generative model
Who acted
Agent acted (contested) — operators drive an installed Hermes Agent over Telegram on hijacked hosts; contested because the agent is the botnet's interface and no victim action is documented
Attack surface
Autonomous operations
Autonomy level
Semi-autonomous
Initial vector
Unauthenticated docker api port 2375
Impact type
Host compromise, Credential theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Docker daemons exposed on port 2375; network-propagating; victim count not stated
Capability abused
Taxonomy & references
Curator notes
ThreatDown's own post (dated 22 September) is the primary source; The Hacker News coverage followed on 28 September. ThreatDown found the operation through an unauthenticated container registry that exposed the crew's toolchain, covering October 2024 to August 2026. Kept separate from AIR-2026-0175 and AIR-2026-0194: those are actors using Hermes as an autonomous offensive operator against chosen targets, whereas this is a self-propagating criminal botnet that installs stock Hermes Agent on hijacked hosts as a Telegram-driven operator interface, run by a different, apparently Costa Rica-linked crew. The agent here acts on operator instructions, hence semi-autonomous. ThreatDown prioritises AI API key theft in the persona prompt but does not report a count of compromised hosts or confirmed victim losses from its read-only registry analysis, so realized impact is not coded.
Supporting sources
Cite as
Enkrypt AI. "CARBONATO botnet turns exposed Docker hosts into Telegram-controlled Hermes Agent nodes". AIR, AIR-2026-0263. https://agentincident.vercel.app/i/AIR-2026-0263/ (accessed 2026-10-19).