Malware

CARBONATO

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

“Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication. The malware connects to that API and instructs the daemon to launch a privileged container.”

Execution

4 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1059Command and Scripting InterpreterEvidence1

“The model interprets the task, writes terminal commands, reads the output, and decides what to do next... The agent runs those commands on the victim.”

T1059.004Unix ShellEvidence1

The model interprets the task, writes terminal commands, reads the output, and decides what to do next. The agent runs those commands on the victim.

Persistence

3 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1547Boot or Logon Autostart ExecutionEvidence1

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

Privilege Escalation

4 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1547Boot or Logon Autostart ExecutionEvidence1

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1611Escape to HostEvidence2

“The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host.”

Stealth

1 technique

T1036MasqueradingEvidence1

The implant runs in a container called systemd-resolved and displays a fake systemd-networkd resolver v2.0 banner. Its process arguments also imitate the kernel thread [kworker/u2:0].

Defense Impairment

1 technique

T1222.002Linux and Mac File and Directory Permissions ModificationEvidence1

They create persistence hooks through cron, systemd timers, rc.local, and OpenRC, then mark those files immutable.

Credential Access

1 technique

T1552Unsecured CredentialsEvidence2

“Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data.”

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

“Scripts that scan networks attached to the host every five minutes.”

Lateral Movement

2 techniques

T1021.004SSHEvidence1

The script also installs an SSH server, adds the crew's key, and opens a reverse SSH tunnel from the victim to a relay.

T1570Lateral Tool TransferEvidence1

“Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop.”

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

“Hermes handles task commands received through Telegram... running commands, and sending back the results.”

T1102Web ServiceEvidence1

Hermes Agent gives the operators a Telegram interface to send tasks to compromised hosts... The agent runs those commands on the victim and returns its report to the Telegram chat.

T1105Ingress Tool TransferEvidence1

Paired watchdogs monitor the deployment and re-pull the implant from the registry if its files or container disappear.

T1572Protocol TunnelingEvidence2

“It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key.”

Impact

1 technique

T1496Resource HijackingEvidence1

The persona lists XMRig and mining among its operational capabilities, and detection guidance identifies a miner at /usr/sbin/systemd-logind.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 day ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Sep 24, 2026

New Carbonato malware uses AI agents to hijack exposed Docker hosts

A Docker-targeting botnet that exploits unauthenticated Docker APIs exposed on port 2375 to launch privileged containers, gain host access, establish reverse SSH tunnels, install persistence mechanisms, steal credentials and tokens, execute commands through an AI-agent command loop, and propagate by scanning connected networks for further exposed Docker daemons.

malware newsNews

Sep 23, 2026

CARBONATO: a botnet built around an AI agent - Malware News - Malware Analysis, News and Indicators

A Docker-targeting worm and botnet implant that compromises unauthenticated Docker daemons exposed on TCP/2375. It launches privileged containers to execute on the host, establishes reverse-SSH access, deploys persistent watchdogs, scans attached networks for further Docker APIs, steals credentials with priority given to AI API keys, and includes a miner disguised as systemd-logind.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

CARBONATO

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

18 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1190Exploit Public-Facing ApplicationEvidence2

“Carbonato spreads across Docker hosts with an API exposed on port 2375 without authentication. The malware connects to that API and instructs the daemon to launch a privileged container.”

Execution

4 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1059Command and Scripting InterpreterEvidence1

“The model interprets the task, writes terminal commands, reads the output, and decides what to do next... The agent runs those commands on the victim.”

T1059.004Unix ShellEvidence1

The model interprets the task, writes terminal commands, reads the output, and decides what to do next. The agent runs those commands on the victim.

Persistence

3 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1547Boot or Logon Autostart ExecutionEvidence1

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

Privilege Escalation

4 techniques

T1053.003CronEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1053.006Systemd TimersEvidence2

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1547Boot or Logon Autostart ExecutionEvidence1

“Scripts set up cron jobs, systemd timers, rc.local, and OpenRC hooks for persistence.”

T1611Escape to HostEvidence2

“The malware connects to that API and instructs the daemon to launch a privileged container, giving it access to the host.”

Stealth

1 technique

T1036MasqueradingEvidence1

The implant runs in a container called systemd-resolved and displays a fake systemd-networkd resolver v2.0 banner. Its process arguments also imitate the kernel thread [kworker/u2:0].

Defense Impairment

1 technique

T1222.002Linux and Mac File and Directory Permissions ModificationEvidence1

They create persistence hooks through cron, systemd timers, rc.local, and OpenRC, then mark those files immutable.

Credential Access

1 technique

T1552Unsecured CredentialsEvidence2

“Hermes handles task commands received through Telegram, including collecting AI API keys, SSH credentials, access tokens, and other data.”

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

“Scripts that scan networks attached to the host every five minutes.”

Lateral Movement

2 techniques

T1021.004SSHEvidence1

The script also installs an SSH server, adds the crew's key, and opens a reverse SSH tunnel from the victim to a relay.

T1570Lateral Tool TransferEvidence1

“Each new compromise pulls the implant from the registry, launches the same privileged container, and enters the persistence and scanning loop.”

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

“Hermes handles task commands received through Telegram... running commands, and sending back the results.”

T1102Web ServiceEvidence1

Hermes Agent gives the operators a Telegram interface to send tasks to compromised hosts... The agent runs those commands on the victim and returns its report to the Telegram chat.

T1105Ingress Tool TransferEvidence1

Paired watchdogs monitor the deployment and re-pull the implant from the registry if its files or container disappear.

T1572Protocol TunnelingEvidence2

“It then opens a reverse SSH tunnel, installs an SSH server with the operators’ key.”

Impact

1 technique

T1496Resource HijackingEvidence1

The persona lists XMRig and mining among its operational capabilities, and detection guidance identifies a miner at /usr/sbin/systemd-logind.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app1 day ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

bleeping computerNews

Sep 24, 2026

New Carbonato malware uses AI agents to hijack exposed Docker hosts

malware newsNews

Sep 23, 2026

CARBONATO: a botnet built around an AI agent - Malware News - Malware Analysis, News and Indicators

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping18

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.