GoKawiilCarbonato Botnet Deploys AI Agents Inside Hijacked Docker Hosts
ThreatDown researchers identified a botnet called Carbonato that targets Docker servers with exposed, unauthenticated daemons on port 2375. After gaining access, attackers launch a privileged container, install a persistent SSH backdoor, and embed an AI agent built on the open-source Hermes Agent framework that receives commands via Telegram and harvests stolen credentials. The infrastructure, exposed since May, was also linked to a separate operation distributing trojanized cryptocurrency wallet apps.