Carbonato botnet targets exposed Docker daemons to deploy Hermes Agent AI

Affected Systems

Docker hosts with exposed or insecurely configured Docker daemons (typically TCP port 2375/2376 without authentication). All Docker versions are potentially affected when daemon API is exposed without proper access controls.

Exploitation Status

Active exploitation confirmed. Carbonato botnet is actively scanning for and compromising exposed Docker daemons in the wild to deploy Hermes Agent AI framework.

Business Impact

Attackers gain full control of compromised Docker hosts, enabling container deployment, data exfiltration, lateral movement, and resource hijacking (cryptomining, DDoS). Organizations with internet-facing Docker daemons or weak internal segmentation face immediate risk of compromise. No CVE assigned as this exploits misconfiguration rather than a software vulnerability.

Urgency

🔴 Immediate

Recommended Actions

• Immediately audit all Docker hosts to ensure Docker daemon API is not exposed to untrusted networks (check for TCP 2375/2376 listeners with 'netstat -tuln | grep 237').
• Disable Docker daemon TCP socket if not required; use Unix socket (/var/run/docker.sock) for local access only. Edit /etc/docker/daemon.json and systemd unit files accordingly.
• If remote access is required, enforce TLS client certificate authentication (--tlsverify) and restrict access via firewall rules to specific management IPs only.
• Monitor Docker API access logs and container creation events for unauthorized activity, especially unexpected image pulls or privileged container launches.
• Search for indicators of Hermes Agent AI framework in running containers and processes; isolate and investigate any Docker hosts showing unexpected outbound connections or resource usage.