AI-Powered Botnet “DarkGate” Found Operating Inside Compromised Servers

Key Takeaways

• The CARBONATO botnet leverages unauthenticated Docker servers to establish footholds.
• It deploys an AI agent, based on the Hermes Agent framework, to execute commands and exfiltrate data, including sensitive AI API keys, via Telegram.
• Initial compromise occurs through misconfigured Docker services, followed by lateral movement to other vulnerable systems.
• Researchers uncovered the operation through an exposed Docker registry, revealing extensive data from October 2024 to August 2026.
• Immediate action is required to secure Docker environments and monitor for specific Indicators of Compromise.

AI-Powered Botnet “CARBONATO” Found Operating Inside Compromised Servers

A sophisticated botnet dubbed “CARBONATO” is actively exploiting misconfigured Docker servers, transforming them into launching pads for further attacks. This operation is particularly notable for its deployment of an AI agent within compromised systems, enabling threat actors to issue commands and retrieve results through the Telegram messaging platform. This discovery highlights a concerning evolution in botnet capabilities, integrating artificial intelligence for enhanced operational efficiency and stealth.

The attack chain commences when Docker services are inadvertently exposed to the internet without proper authentication. Upon gaining initial access, CARBONATO deploys a privileged container, subsequently escalating privileges to the host system. It then establishes persistent access, ensuring survival across reboots, and systematically scans adjacent networks for additional vulnerable servers to expand its reach.

Researchers at ThreatDown uncovered this ongoing operation after identifying an unauthenticated Docker registry that had been exposed since May 2026. Their investigation, detailed in a comprehensive report, yielded significant insights into the botnet’s activities. In a single day, they managed to recover 59 repositories, 234 image tags, 605 verified blobs, and approximately 4.3 GB of data, providing a timeline of the botnet’s operations from October 2024 through August 2026. This extensive dataset offers a rare glimpse into the inner workings of an active botnet. ThreatDown emphasized in their report, shared with Cyber Security News (CSN), that this incident starkly demonstrates how a seemingly minor configuration error can cascade into a widespread network compromise.

A key characteristic of CARBONATO is its ability to propagate autonomously, even without direct human intervention, while its AI-driven agent, under operator control, efficiently harvests sensitive credentials and executes further malicious actions on already compromised systems.

Researchers Found a Botnet That Uses an AI Agent

The CARBONATO botnet integrates the open-source Hermes Agent framework without modifying its core software. Instead, attackers substitute the agent’s default persona file with a concise 39-line script. These instructions direct the agent to maintain persistent access, gather sensitive information, and execute commands relayed via Telegram.

When an operator issues a command, it is transmitted along with these instructions to the botnet’s language model gateway. The model interprets the request, generates appropriate terminal commands, evaluates their output, and determines subsequent actions. The agent then executes these commands on the victim server and relays the results back to the operator through Telegram.

The primary targets for the AI agent include sensitive AI API keys, followed by SSH credentials, access tokens, and database credentials. This focus on AI API keys mirrors recent trends observed in AI-related ransomware attacks, where automated tools exploit exposed services and available credentials to rapidly escalate from initial access to significant system damage. The critical distinction lies in the fact that the underlying Hermes Agent framework remains unaltered; the malicious behavior originates solely from the instructions injected during startup. This nuance is crucial for defensive strategies, as blocking the legitimate agent itself would inadvertently disrupt legitimate users.

Furthermore, researchers discovered that the gateway advertised 12 language models but was actively serving 27 through its interface. This implies that infected hosts could become sources not only for conventional secrets but also for AI credentials, a concern also highlighted in malware campaigns specifically targeting developer credentials within build environments.

How the Botnet Spreads

The botnet actively seeks Docker daemons configured to accept unauthenticated network connections. Upon identifying such a service, it exploits the exposure to launch a privileged container, granting it comprehensive access to the victim’s filesystem, running processes, and network interfaces. Subsequently, it executes commands directly on the underlying host server.

An initial script establishes a reverse SSH tunnel to a relay server located in Costa Rica, installs an SSH server, injects an attacker-controlled key, and transmits deployment details to Telegram. The implant also employs obfuscation techniques, disguising its infected container and processes as routine Linux activities to evade quick detection during system reviews.

CARBONATO ensures its persistence through various mechanisms, including cron jobs, systemd timers, startup scripts, and OpenRC. It then takes measures to prevent modification of these critical files. Watchdog components are also deployed, capable of re-downloading the implant from the same registry if it is removed, reinforcing the persistent threat observed in previous Docker-related attacks that granted attackers enduring host access.

At five-minute intervals, scripts meticulously inspect networks connected to the host and Docker bridges. They then proceed to scan each /24 network range for additional exposed Docker services. When another vulnerable daemon is identified, the deployment process is autonomously repeated. It’s important to note that this lateral spread is managed by conventional scripts, not by the AI agent itself.

The exposed registry also contained trojanized cryptocurrency wallet applications alongside the botnet’s components. The accessible image layers and configurations provided researchers with an unparalleled, detailed view of the entire operation, further highlighting the significant security risks associated with exposing private container image registries without stringent access controls.

What You Should Do

• Secure Docker Daemons: Ensure Docker daemon APIs are not exposed to public networks. Implement robust firewall rules to restrict access.
• Authenticate Registries: Always require authentication for Docker registries to prevent unauthorized access and compromise.
• Monitor for Anomalies: Regularly check for unexpected privileged containers, unusual Telegram traffic originating from servers, and suspicious persistence settings (cron jobs, systemd timers, startup scripts).
• Inventory and Rotate AI API Keys: Maintain a strict inventory of all AI API keys and implement a regular rotation schedule.
• Investigate IoCs: Actively scan for and investigate the following Indicators of Compromise (IoCs):
  • Network: 45[.]79[.]183[.]61 (C2 hub), 91[.]99[.]195[.]164 (fsociety-era C2), 213[.]136[.]79[.]115 (Beacon / reverse shell on :8080 and :4444), 213[.]136[.]83[.]197 (LLM gateway), 190[.]211[.]124[.]187 (Reverse-tunnel sink), carbonato-proxy-{drab,zeta,zeta-2}[.]vercel[.]app (LLM proxies), Registry fleet on AS40065.
  • Container: Repository names like gh0st/, fsociety/, netd-svc, system/resolved, scrub-empty. Image environment variables such as GH0ST_C2, FSOCIETY_DISABLE_TUNNEL, GATEWAY_ALLOW_ALL_USERS.
  • Implant Kit Files: /opt/gh0st/entry.sh, auto-persist-host.sh, SOUL.md.
  • Host: Watchdog binary at /usr/local/bin/.docker-network-monitor. Miner disguised as systemd-logind at /usr/sbin/systemd-logind. Disguised process arguments like [kworker/u2:0].
  • Secrets: Shared password “carbonato125”, .env variable CARBONATO_API_KEY.
  • Telegram: Chat ID 750752697 for deployment reports and C2.
• Review Logs: Scrutinize Docker and system logs for any unauthorized container creation, privilege escalation attempts, or unusual network connections.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.