CARBONATO Docker Botnet + Year-End Phishing Lures: OTX Pulse Analysis — AI-Agent Malware & Credential Harvesting Detection Pack

---
title: CARBONATO Botnet - Exposed Docker Daemon Exploitation
id: 8f3a9d2e-1b4c-4e8a-9c6d-3f7e2a1b5c9d
status: experimental
description: Detects suspicious Docker daemon activity indicative of CARBONATO botnet compromise, including unauthenticated API access and malicious container creation
author: Security Arsenal Threat Intelligence
references:
    - https://www.threatdown.com/blog/carbonato/
date: 2026/10/24
modified: 2026/10/24
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1610
logsource:
    category: network_connection
    product: linux
detection:
    selection_docker_api:
        DestinationPort: 2375
        Initiated: 'true'
    selection_external_source:
        SourceIp|cidr:
            - '0.0.0.0/0'
    filter_localhost:
        SourceIp:
            - '127.0.0.1'
            - '::1'
    filter_rfc1918:
        SourceIp|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection_docker_api and selection_external_source and not (filter_localhost or filter_rfc1918)
falsepositives:
    - Legitimate remote Docker management (should use TLS on port 2376)
level: high
---
title: Suspicious Docker Container Creation via API
id: 4b8e1f3a-2c5d-4a9b-8e7f-1d6c3b2a9e8f
status: experimental
description: Detects Docker container creation events with suspicious characteristics associated with CARBONATO botnet deployment
author: Security Arsenal Threat Intelligence
references:
    - https://www.threatdown.com/blog/carbonato/
date: 2026/10/24
modified: 2026/10/24
tags:
    - attack.execution
    - attack.t1610
    - attack.persistence
    - attack.t1053
logsource:
    product: linux
    service: docker
detection:
    selection_container_create:
        ContainerCreate: 'true'
    selection_suspicious_restart:
        RestartPolicy: 'always'
    selection_suspicious_images:
        ImageName|contains:
            - 'hermes'
            - 'carbonato'
            - 'wallet'
    selection_privileged:
        Privileged: 'true'
    condition: selection_container_create and (selection_suspicious_restart or selection_suspicious_images or selection_privileged)
falsepositives:
    - Legitimate containerized applications with restart policies
    - Development/testing environments
level: medium
---
title: Year-End Phishing - SharePoint/DocuSign Impersonation Credential Harvest
id: 7c2d4e9a-3f1b-4d8c-9a5e-2f6b8c1d4e7a
status: experimental
description: Detects network connections to known year-end phishing infrastructure impersonating SharePoint and DocuSign for credential theft
author: Security Arsenal Threat Intelligence
references:
    - https://www.netcraft.com/blog/year-end-phishing-lures-fake-raises-q4-invoices-and-access-reviews
date: 2026/10/24
modified: 2026/10/24
tags:
    - attack.credential_access
    - attack.t1557
    - attack.initial_access
    - attack.t1566
logsource:
    category: network_connection
detection:
    selection_phishing_ips:
        DestinationIp:
            - '157.7.189.101'
            - '157.7.44.119'
            - '118.20.84.128'
            - '123.98.253.31'
    selection_phishing_domains:
        DestinationHostname:
            - 'rsfashionsdesignbd.com'
            - 'bvlbetonvloeren.be'
            - 'englaus.sbs'
            - 'tropical100.com.do'
    condition: selection_phishing_ips or selection_phishing_domains
falsepositives:
    - None expected; these are active phishing indicators
level: critical

// Hunt for year-end phishing infrastructure connections and credential exposure
// Query covers both network connections to known IOCs and process execution patterns

let phishing_ips = dynamic(["157.7.189.101", "157.7.44.119", "118.20.84.128", "123.98.253.31"]);
let phishing_domains = dynamic(["rsfashionsdesignbd.com", "bvlbetonvloeren.be", "englaus.sbs", "tropical100.com.do"]);

// Part 1: Identify network connections to phishing infrastructure
let NetworkConnections = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (phishing_ips) or RemoteUrl has_any (phishing_domains)
| project 
    Timestamp = TimeGenerated,
    DeviceName,
    DeviceId,
    InitiatingProcessAccountName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteIP,
    RemoteUrl,
    RemotePort,
    Protocol,
    ActionType;

// Part 2: Correlate with browser processes (credential entry likely)
let BrowserActivity = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe")
| project
    DeviceId,
    ProcessTimestamp = TimeGenerated,
    ProcessAccountName = AccountName,
    ProcessFileName = FileName,
    ProcessCommandLine = ProcessCommandLine;

// Part 3: Check for exposed Docker daemon (CARBONATO vector)
let DockerExposure = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where LocalPort == 2375
| where ActionType == "ListeningConnection"
| project
    DockerTimestamp = TimeGenerated,
    DeviceName,
    DeviceId,
    LocalPort,
    RemoteIP;

// Union and enrich
NetworkConnections
| join kind=leftouter (BrowserActivity) on DeviceId
| extend AlertSeverity = case(
    RemoteIP in (phishing_ips), "Critical - Known Phishing IP",
    RemoteUrl has_any (phishing_domains), "Critical - Known Phishing Domain",
    "Medium"
)
| extend RecommendedAction = case(
    AlertSeverity contains "Critical", "Isolate device, reset user credentials, review browser history",
    "Investigate connection context"
)
| union (DockerExposure | extend AlertSeverity="High - Exposed Docker Daemon", RecommendedAction="Disable Docker API on 2375 or enable TLS authentication")
| order by Timestamp desc

<#
.SYNOPSIS
    CARBONATO Botnet and Year-End Phishing IOC Hunt Script
.DESCRIPTION
    Hunts for indicators of CARBONATO botnet compromise (exposed Docker daemon) and
    connections to year-end phishing infrastructure. Checks for suspicious Docker
    containers, network connections to phishing IOCs, and browser artifacts.
.NOTES
    Author: Security Arsenal Threat Intelligence
    Date: 2026-10-24
    Requires: Administrative privileges, PowerShell 5.1+
#>

# Requires -RunAsAdministrator

Write-Host "[+] CARBONATO & Year-End Phishing IOC Hunt" -ForegroundColor Cyan
Write-Host "[+] Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`n" -ForegroundColor Cyan

# IOC Definitions
$phishingIPs = @("157.7.189.101", "157.7.44.119", "118.20.84.128", "123.98.253.31")
$phishingDomains = @("rsfashionsdesignbd.com", "bvlbetonvloeren.be", "englaus.sbs", "tropical100.com.do")
$suspiciousDockerImages = @("hermes", "carbonato", "wallet", "crypto")

# Part 1: Check for Docker daemon exposure
Write-Host "[1] Checking for exposed Docker daemon (TCP 2375)..." -ForegroundColor Yellow
try {
    $dockerListening = Get-NetTCPConnection -LocalPort 2375 -State Listen -ErrorAction SilentlyContinue
    if ($dockerListening) {
        Write-Host "    [!] ALERT: Docker daemon listening on port 2375" -ForegroundColor Red
        $dockerListening | ForEach-Object {
            Write-Host "        Local Address: $($_.LocalAddress):$($_.LocalPort)" -ForegroundColor Red
            Write-Host "        Owning Process: $(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ProcessName)" -ForegroundColor Red
        }
        Write-Host "    [ACTION REQUIRED] Disable unauthenticated Docker API or enable TLS on port 2376`n" -ForegroundColor Red
    } else {
        Write-Host "    [OK] Docker daemon not exposed on port 2375`n" -ForegroundColor Green
    }
} catch {
    Write-Host "    [INFO] Unable to check Docker port: $($_.Exception.Message)`n" -ForegroundColor Gray
}

# Part 2: Check running Docker containers (if Docker is installed)
Write-Host "[2] Checking for suspicious Docker containers..." -ForegroundColor Yellow
try {
    $dockerInstalled = Get-Command docker -ErrorAction SilentlyContinue
    if ($dockerInstalled) {
        $containers = docker ps --format "{{.ID}}|{{.Image}}|{{.Names}}|{{.Status}}" 2>$null
        if ($containers) {
            $suspiciousFound = $false
            foreach ($container in $containers) {
                $parts = $container -split '\|'
                $imageName = $parts[1]
                foreach ($suspicious in $suspiciousDockerImages) {
                    if ($imageName -like "*$suspicious*") {
                        Write-Host "    [!] ALERT: Suspicious container detected" -ForegroundColor Red
                        Write-Host "        Container ID: $($parts[0])" -ForegroundColor Red
                        Write-Host "        Image: $imageName" -ForegroundColor Red
                        Write-Host "        Name: $($parts[2])" -ForegroundColor Red
                        Write-Host "        Status: $($parts[3])" -ForegroundColor Red
                        $suspiciousFound = $true
                    }
                }
            }
            if (-not $suspiciousFound) {
                Write-Host "    [OK] No obviously suspicious containers found`n" -ForegroundColor Green
            } else {
                Write-Host "    [ACTION REQUIRED] Investigate suspicious containers and consider quarantine`n" -ForegroundColor Red
            }
        } else {
            Write-Host "    [INFO] No running containers`n" -ForegroundColor Gray
        }
    } else {
        Write-Host "    [INFO] Docker not installed on this system`n" -ForegroundColor Gray
    }
} catch {
    Write-Host "    [ERROR] Unable to enumerate containers: $($_.Exception.Message)`n" -ForegroundColor Red
}

# Part 3: Check active network connections to phishing IOCs
Write-Host "[3] Checking for active connections to phishing infrastructure..." -ForegroundColor Yellow
$connectionsFound = $false
foreach ($ip in $phishingIPs) {
    $connections = Get-NetTCPConnection -RemoteAddress $ip -ErrorAction SilentlyContinue
    if ($connections) {
        foreach ($conn in $connections) {
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "    [!] ALERT: Active connection to known phishing IP" -ForegroundColor Red
            Write-Host "        Remote IP: $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
            Write-Host "        Local Port: $($conn.LocalPort)" -ForegroundColor Red
            Write-Host "        State: $($conn.State)" -ForegroundColor Red
            Write-Host "        Process: $($process.ProcessName) (PID: $($conn.OwningProcess))" -ForegroundColor Red
            $connectionsFound = $true
        }
    }
}
if (-not $connectionsFound) {
    Write-Host "    [OK] No active connections to known phishing IPs`n" -ForegroundColor Green
} else {
    Write-Host "    [ACTION REQUIRED] Isolate host and reset credentials for affected users`n" -ForegroundColor Red
}

# Part 4: Check DNS cache for phishing domains
Write-Host "[4] Checking DNS cache for phishing domain lookups..." -ForegroundColor Yellow
$dnsFound = $false
foreach ($domain in $phishingDomains) {
    $dnsCache = Get-DnsClientCache -Name $domain -ErrorAction SilentlyContinue
    if ($dnsCache) {
        Write-Host "    [!] ALERT: DNS cache entry found for phishing domain" -ForegroundColor Red
        Write-Host "        Domain: $domain" -ForegroundColor Red
        Write-Host "        Resolved IP: $($dnsCache.Data -join ', ')" -ForegroundColor Red
        $dnsFound = $true
    }
}
if (-not $dnsFound) {
    Write-Host "    [OK] No phishing domains found in DNS cache`n" -ForegroundColor Green
} else {
    Write-Host "    [ACTION REQUIRED] Review proxy logs and identify users who accessed these domains`n" -ForegroundColor Red
}

# Part 5: Check browser history artifacts (Chrome/Edge)
Write-Host "[5] Checking browser history for phishing domain access..." -ForegroundColor Yellow
$browserPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
$browserFound = $false
foreach ($path in $browserPaths) {
    if (Test-Path $path) {
        # Note: Direct SQLite parsing requires third-party module or System.Data.SQLite
        # This is a simplified check for file existence and recent modification
        $historyFile = Get-Item $path
        if ($historyFile.LastWriteTime -gt (Get-Date).AddDays(-7)) {
            Write-Host "    [INFO] Recent browser history detected: $path" -ForegroundColor Gray
            Write-Host "        Last Modified: $($historyFile.LastWriteTime)" -ForegroundColor Gray
            Write-Host "        Manual review recommended (requires SQLite browser history parser)" -ForegroundColor Gray
        }
    }
}
Write-Host ""

# Part 6: Summary and recommendations
Write-Host "===== HUNT SUMMARY =====" -ForegroundColor Cyan
if ($dockerListening -or $connectionsFound -or $dnsFound) {
    Write-Host "[CRITICAL] Indicators of compromise detected. Immediate action required:" -ForegroundColor Red
    Write-Host "  1. Isolate affected systems from network" -ForegroundColor Red
    Write-Host "  2. Reset credentials for all users on affected systems" -ForegroundColor Red
    Write-Host "  3. Review firewall/proxy logs for lateral movement" -ForegroundColor Red
    Write-Host "  4. If Docker daemon exposed, audit all containers and images" -ForegroundColor Red
    Write-Host "  5. File incident response ticket and preserve forensic evidence" -ForegroundColor Red
} else {
    Write-Host "[OK] No immediate indicators detected on this system" -ForegroundColor Green
    Write-Host "  Continue monitoring for IOC updates" -ForegroundColor Green
}
Write-Host "`n[+] Hunt complete: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan