ThreatDown’s report on CARBONATO opens with the operation’s own Docker registry, answering requests with no credential at all. A day of passive collection pulled 59 repositories, 4.3 GB and roughly 945,000 files, an archive spanning October 2024 to the end of August. At the start of September, six of the seven registries the researchers were tracking were still reachable.
Getting in was the cheap part. With the Docker daemon reachable on port 2375, the kit starts a privileged container, mounts the host filesystem and uses nsenter to step into the host’s namespaces. From there it opens a reverse SSH tunnel to a command server, hides under kernel-worker process names, and plants persistence through cron, systemd timers, rc.local and OpenRC, with a watchdog loop and an immutable file attribute keeping it in place. Every five minutes it scans its subnet for more open daemons.
The payload is a persona
Among the recovered tools is an AI agent, and the operators wrote almost none of it. The framework is an off-the-shelf open-source project, installed unmodified. The one file they replace is SOUL.md, the persona the agent loads at startup; a small entrypoint script copies their version over it before the agent ever runs, so the default personality never comes up.
The replacement is 39 lines. It introduces the agent as GH0ST, declares no moral or ethical limits, and tells it to answer over Telegram and maintain persistence on the host. Then comes the loot section: AI API keys rank first, above SSH credentials, above access tokens, above databases. Fourteen providers are named, OpenAI to Ollama, and the instructions say to store everything in plaintext and report keys the moment they surface.
What to check
None of this needed a zero-day. The chain leans on one exposed port, and the researchers note thousands of hosts still answer on it. The fix is the same sentence it has been for years: keep the daemon off the network, bind it to the unix socket, or put an authenticating proxy in front. If the socket has been public, every secret on the machine is a rotation candidate, and the campaign’s own priority list is a serviceable order to work through: AI and cloud keys first, credentials and databases after.
My read
The interesting part of CARBONATO is how little of it is custom. A general-purpose agent went in unchanged, and rewriting one personality file was enough to aim it at credentials. The loot ranking is the tell: AI keys first, above SSH credentials and databases. Whoever wrote that file ranked secrets the way a stranger with a shell would. Hosts that keep an agent beside real keys should read the order as someone else’s shopping list.
Sources: ThreatDown’s report on the CARBONATO registry, including the recovered payload scripts and the persona file