What is confirmed
ThreatDown's 22 September research began with an unauthenticated Docker registry: 59 repositories, 234 tags and 4.3 GB of read-only evidence. The material spans October 2024 to August 2026; a 24 September news report brought wider attention.
The implant targets unauthenticated Docker APIs on port 2375. It instructs the daemon to launch a privileged container with host access, then establishes persistence and remote access.
Carbonato deploys Hermes Agent with a modified GH0ST persona. Its instructions prioritise AI API keys, then SSH credentials and tokens; scripts seek further Docker daemons on adjacent networks.
What it means
The documented entry point is an exposed Docker API without access control. The AI agent handles post-compromise tasks; the research does not establish autonomous discovery of every victim.
Host compromise can expose mounted container secrets and deployment credentials. The published evidence does not establish a global victim count.
What to do
Inventory Docker daemons and ensure port 2375 is not reachable from the internet or untrusted networks. Remove unnecessary exposure and require registry authentication.
For a suspected host, isolate it and inspect privileged containers, host mounts, SSH services, persistence and Telegram traffic; rotate affected API keys and SSH credentials after investigation.
External checks may reveal some signals, but investigating Carbonato requires Docker host inventory and analysis.
