A new botnet campaign called Carbonato has emerged, marking a notable shift in automated cyber attacks by deploying an AI agent framework to orchestrate hijacked Docker hosts. According to researchers, the malware targets a common cloud misconfiguration to install the Hermes Agent, moving from static scripts to adaptive, natural-language command and control.
The attack chain, detailed by BleepingComputer, begins with Carbonato scanning for Docker daemons exposed on the public internet without authentication. Upon compromising a host, it launches a container and installs the Hermes Agent, an open-source AI framework. Once active, this agent allows attackers to issue conversational commands to manage the hijacked resource, automating tasks like reconnaissance and cryptominer deployment.
This represents a key evolution in botnet operations. "The AI provides a layer of dynamic decision-making, allowing operators to issue high-level goals rather than fixed command sets," the report notes. This enables more efficient scaling across multiple compromised nodes while enhancing adaptability and evasion.
The fundamental vulnerability exploited remains the exposure of the Docker Engine API to the internet without proper controls—a persistent configuration error in many environments. The AI agent functions as an orchestrator, managing the malicious container's lifecycle and facilitating further malicious activity.
To counter this threat, security researchers recommend immediate hardening of Docker environments:
* Secure the API Endpoint: Bind the daemon to a local Unix socket or a private, firewalled network interface. Never expose it to the public internet.
* Enforce Authentication: Require and configure TLS client certificate authentication for any remote API access.
* Apply Least Privilege: Run containers as non-root users and avoid the --privileged flag.
* Audit and Monitor: Regularly scan for exposed endpoints and deploy runtime monitoring to detect anomalous container behavior, such as unexpected network activity or resource usage.
The Carbonato campaign highlights a growing trend: the weaponization of accessible AI frameworks to automate and enhance post-exploitation phases of attacks. This shift challenges traditional, signature-based security models and underscores the need for defense-in-depth strategies. As AI-powered attack tools become more refined, robust control-plane security and behavioral analysis are becoming critical components of cloud-native infrastructure defense.
一個名為Carbonato的新興殭屍網絡活動，透過部署AI代理框架來協調被劫持的Docker主機，標誌著自動化網絡攻擊的一個顯著轉變。研究人員指出，該惡意軟件利用常見的雲端配置錯誤來安裝Hermes代理，從靜態腳本轉向具備自適應能力的自然語言命令與控制。
據BleepingComputer詳細報導，攻擊鏈始於Carbonato掃描暴露在公共互聯網上且未設有認證的Docker守護進程。一旦成功入侵主機，它便會啟動容器並安裝開源AI框架Hermes代理。該代理啟動後，攻擊者可發出對話式指令來管理被劫持的資源，自動化偵察及加密貨幣挖礦等任務。
這代表著殭屍網絡運作的一個關鍵演進。報告指出：「AI提供了動態決策層，讓營運商能夠發出高層級目標，而非固定的指令集。」這使得在多個被入侵節點間進行更高效的擴展成為可能，同時增強了適應性及規避能力。
被利用的根本漏洞仍然是Docker引擎API在未經適當控制下暴露於互聯網——這在許多環境中是一個長期存在的配置錯誤。AI代理在此擔任協調器的角色，管理惡意容器的生命週期並促成進一步的惡意活動。
為應對此威脅，安全研究人員建議立即加強Docker環境的安全性：
* 保護API端點： 將守護進程綁定至本地Unix socket或私有、受防火牆保護的網絡接口。切勿將其暴露於公共互聯網。
* 強制認證： 對任何遠端API存取要求並配置TLS客戶端證書認證。
* 落實最小權限： 以非root用戶運行容器，並避免使用 --privileged 標誌。
* 審計與監控： 定期掃描暴露的端點，並部署運行時監控以偵測異常的容器行為，例如意外的網絡活動或資源使用情況。
Carbonato活動凸顯了一個日益增長的趨勢：將易於獲取的AI框架武器化，以自動化及增強攻擊的後利用階段。這一轉變對傳統的基於特徵碼的安全模型構成挑戰，並突顯了採用縱深防禦策略的必要性。隨著AI驅動的攻擊工具日趨精進，強大的控制平面安全性和行為分析正成為雲原生基礎設施防禦的關鍵組件。