Loading story…
The newly identified Carbonato botnet compromises Docker daemon APIs exposed without authentication on TCP port 2375. It deploys privileged containers to gain host-level execution, creates reverse SSH access, installs persistence through multiple Linux startup mechanisms, and propagates by scanning connected /24 networks every five minutes for additional reachable Docker APIs. Researchers found evidence of the operation spanning October 2024 through August 2026, including an exposed registry containing 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of images.
Carbonato installs the legitimate Hermes Agent framework but modifies its SOUL.md persona to create an agent called GH0ST, which receives tasks through Telegram. The agent can collect credentials—including AI API keys—execute commands, and exfiltrate results, while Telegram also provides operator reporting on deployments. Researchers have not attributed the activity to a known threat group; linguistic, infrastructure, configuration, and Telegram-handle evidence suggests a possible Costa Rica link but remains inconclusive.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Six of seven known Carbonato registry endpoints, phishing sites, the CDN, and the LLM gateway remained online as of September 3, 2026.
Researchers found a publicly exposed, unauthenticated Docker registry on a US-based server containing 59 repositories, 234 image tags, and approximately 4.3 GB of image data. The archive documented both Carbonato botnet infrastructure and trojanized cryptocurrency wallet applications.
The unauthenticated Docker registry used in the operation had reportedly been discoverable by internet-wide scanners since May 2026.
Recovered Carbonato container and operational artifacts contain timestamps beginning in October 2024, indicating the operation was active by that month.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026Akamai researchers have identified a new malware variant targeting exposed Docker APIs, evolving from cryptojacking to botnet-building. The malware blocks external access to Docker APIs, installs persistence mechanisms, and propagates itself to other vulnerable systems. It also contains dormant code for Telnet and Chrome debugging port exploitation, indicating potential for future credential theft and DDoS attacks.
Jun 29, 2026
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026