CARBONATO: The Botnet That Installs an AI Agent on Your Exposed Docker Servers to Steal LLM Keys

ThreatDown (Malwarebytes) documented a botnet that doesn’t ship a fixed script: it installs a full AI agent on every misconfigured Docker server and tells it, over Telegram, to hunt for LLM API keys. The way in is old; what stays behind is new.

What CARBONATO Is and How It Was Found

According to BleepingComputer, The Hacker News and Security Affairs, ThreatDown researchers found CARBONATO after stumbling on an unauthenticated Docker container registry open to the internet. It held about 60 repositories (59 according to Security Affairs) and 4.3 GB of images, with operational evidence running from October 2024 to August 2026. The campaign went public in late September 2026.

ThreatDown could not tie it to any known group. Several clues point to Costa Rica as a possible location for the operators: UTC-06:00 timestamps, a Telegram username that includes 506 (Costa Rica’s phone prefix) and infrastructure on a Costa Rican network. These are indicators, not firm attribution.

How It Works: From Port 2375 to the Agent

The entry vector is a classic: Docker daemons with the API exposed without authentication on port 2375. Once inside, the malware:

This is where it differs from a traditional botnet. The attackers overwrote the agent’s personality file (SOUL.md) with a prompt of about 39 lines that turns it into "GH0ST", a supposed senior hacker that obeys the operator’s orders received over Telegram, with no ethical restrictions. In the researchers’ words, the model interprets the task, writes terminal commands, reads the output and decides what to do next.

The Target: LLM API Keys

According to Security Affairs, the agent is instructed to prioritize keys from 14 LLM providers and tools (OpenAI, Anthropic, Google, OpenRouter, Together, Groq, Mistral, Cohere, Ollama, vLLM, LiteLLM, among others) over SSH credentials or tokens. The operators would use those keys to power their own LLM gateway: ThreatDown found one running as of September 3, 2026, on a free plan, serving 27 models while advertising 12.

What Changes When the Malware Carries an AI Agent

A botnet script does what its author programmed. An agent with terminal access can adapt to its environment: read the system, improvise commands and decide which credentials are worth taking. That doesn’t make the intrusion more sophisticated at the entry point (it’s still an open port), but it does make it harder to predict what happens next. The defense, on the other hand, is the same as ever.