Carbonato Botnet Hijacking Exposed Docker Daemons with AI Agents — Detection and Hardening Guide

---
title: Suspicious Container Creation with Host Root Mount or Privileged Mode
id: 3f8c2a41-7b9e-4d1c-a5f6-9c2e1b7d3a05
status: experimental
description: Detects docker client or API-driven container creation that bind-mounts the host root filesystem or requests privileged mode, consistent with Carbonato-style compromise of an exposed Docker daemon.
references:
  - https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
  - https://attack.mitre.org/techniques/T1610/
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.execution
  - attack.privilege_escalation
  - attack.t1610
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/docker'
      - '/docker-cli'
      - '/ctr'
      - '/nerdctl'
  selection_flag:
    CommandLine|contains:
      - 'run'
      - 'create'
  selection_escape:
    CommandLine|contains:
      - '--privileged'
      - '-v /:/'
      - '-v /:/host'
      - '--volume /:/'
      - '/:/host'
      - '--pid=host'
      - '--net=host'
      - '--cap-add SYS_ADMIN'
  condition: selection_img and selection_flag and selection_escape
falsepositives:
  - Legitimate host-management containers (monitoring agents, backup tooling) — baseline known images
level: high
---
title: Docker Remote API Access Over Unauthenticated Port 2375
id: 8a1e5c72-3d4b-4f6a-b2c8-5e7d9a1f3b26
status: experimental
description: Detects inbound network connections to the Docker daemon on TCP 2375 (unauthenticated plaintext API), the primary access vector abused by the Carbonato botnet.
references:
  - https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1610
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort: 2375
    Image|endswith:
      - '/dockerd'
  condition: selection
falsepositives:
  - Internal orchestration traffic where 2375 is intentionally (though insecurely) used — treat any hit as a finding to remediate
level: high
---
title: Shell or Interpreter Spawned by Container Runtime
id: b62d9f18-4e7a-4c35-9d81-2a6c8e4f7b19
status: experimental
description: Detects shells or script interpreters spawned directly by dockerd or containerd, a common post-exploitation artifact when attackers execute commands through a container escape or a bind-mounted host filesystem, as seen in Carbonato infections.
references:
  - https://www.bleepingcomputer.com/news/security/new-carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/dockerd'
      - '/containerd'
      - '/containerd-shim'
      - '/containerd-shim-runc-v2'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/crontab'
      - '/systemctl'
  condition: selection_parent and selection_child
falsepositives:
  - Containers whose entrypoint is a shell script — filter by image name or container ID in your environment
level: medium

let Lookback = 14d;
let DockerHosts = (DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where LocalPort in (2375, 2376)
    | summarize arg_max(Timestamp, *) by DeviceName);
// Part 1: Inbound connections to Docker Remote API from non-private IPs
let RemoteAPIAccess = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where LocalPort in (2375, 2376)
    | where RemoteIPType == "Public"
    | summarize Connections=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp),
        SourceIPs=make_set(RemoteIP), Actions=make_set(ActionType) by DeviceName, LocalPort
    | project DeviceName, LocalPort, Connections, FirstSeen, LastSeen, SourceIPs;
// Part 2: Suspicious container execution / escape-style command lines
let SuspiciousContainerExec = DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where DeviceName in (DockerHosts | project DeviceName)
    | where ProcessCommandLine has_any ("--privileged", "/:/host", "-v /:/", "--pid=host", "--cap-add")
       or (InitiatingProcessFileName has_any ("dockerd", "containerd")
           and FileName in~ ("sh", "bash", "dash", "python", "python3", "curl", "wget", "crontab", "systemctl"))
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName,
        InitiatingProcessCommandLine, AccountName;
union RemoteAPIAccess, SuspiciousContainerExec
| order by DeviceName asc

-- Carbonato Docker host triage: runtime processes, API listeners, persistence
SELECT * FROM {
  -- Processes tied to container runtime and suspicious child processes
  SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime, 'process' AS Artifact
  FROM pslist()
  WHERE Name =~ 'docker|containerd|runc|hermes'
     OR (CommandLine =~ 'privileged|/:/host|--pid=host|--cap-add'
         AND CommandLine =~ 'docker|ctr|nerdctl')
} UNION {
  -- Listening sockets: flag Docker API bound to non-loopback interfaces
  SELECT Pid, NULL AS Ppid, Name, String AS CommandLine, Laddr AS Exe,
         Raddr AS Username, NULL AS CreateTime, 'listener' AS Artifact
  FROM netstat()
  WHERE Laddr.Port in (2375, 2376) AND Laddr.IP !~ '^127\\.'
} UNION {
  -- Persistence surfaces commonly written via host bind mount
  SELECT NULL AS Pid, NULL AS Ppid, Name, FullPath AS CommandLine,
         Size.String AS Exe, Mtime.String AS Username, NULL AS CreateTime,
         'persistence_file' AS Artifact
  FROM glob(globs=[
    '/etc/cron.d/*',
    '/etc/systemd/system/*.service',
    '/etc/systemd/system/*.timer',
    '/usr/local/bin/*hermes*',
    '/opt/*hermes*',
    '/root/.ssh/authorized_keys'
  ])
  WHERE Mtime > now() - 1209600
}

#!/bin/bash
# Carbonato exposure triage & hardening for Docker hosts
echo "=== [1] Docker daemon listening sockets ==="
ss -tlnp | grep -E ':(2375|2376)' && echo "[!] Docker API is network-reachable" || echo "[OK] No TCP Docker API listener"

echo "=== [2] Daemon configuration review ==="
grep -rE '"hosts"|tcp://' /etc/docker/daemon.json /etc/systemd/system/docker.service.d/ 2>/dev/null
grep -E 'ExecStart.*(-H|--host).*tcp' /lib/systemd/system/docker.service /etc/systemd/system/docker.service.d/*.conf 2>/dev/null

echo "=== [3] Suspicious containers: privileged / host-root mounts ==="
for c in $(docker ps -aq 2>/dev/null); do
  docker inspect "$c" --format '{{.Name}} | Image={{.Config.Image}} | Privileged={{.HostConfig.Privileged}} | Binds={{.HostConfig.Binds}} | Created={{.Created}}' 2>/dev/null
done | grep -Ei 'true|/:/|/host|unknown|alpine|busybox' 

echo "=== [4] Recently pulled images (review for anything you did not deploy) ==="
docker images --format '{{.Repository}}:{{.Tag}} | {{.CreatedAt}} | {{.ID}}' 2>/dev/null | head -30

echo "=== [5] Persistence check: recent cron/systemd/SSH changes ==="
find /etc/cron.d /etc/cron.daily /etc/systemd/system -type f -mtime -14 2>/dev/null
stat -c '%y %n' /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/null

echo "=== [6] Hunt for Hermes Agent artifacts ==="
find / -iname '*hermes*' -type f -mtime -30 2>/dev/null | grep -vE '^/(proc|sys)'
ps aux | grep -i hermes | grep -v grep

echo "=== [7] Outbound connections from container runtime processes ==="
ss -tnp | grep -E 'dockerd|containerd|hermes'

# --- HARDENING (review before running) ---
# 1) Remove any tcp:// binding from daemon.json and systemd overrides; use the local socket only.
# 2) If remote API access is required, enforce TLS with client certs on 2376:
#    "tlsverify": true, "tlscacert", "tlscert", "tlskey" in daemon.json
# 3) Block the ports at the edge even after fixing the daemon (defense in depth):
#    sudo iptables -A INPUT -p tcp --dport 2375 -j DROP
#    sudo iptables -A INPUT -p tcp --dport 2376 ! -s <approved_mgmt_cidr> -j DROP
# 4) Restart docker to apply: sudo systemctl restart docker