CARBONATO is a botnet that turns Docker servers into footholds for attackers This article explores carbonato botnet. . In just one day, they managed to recover 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of data from October 2024 through August 2026.

CARBONATO spreads without requiring new instructions, whereas its operator-controlled agent can steal sensitive credentials and carry out additional actions on compromised systems. The exposed image layers and configurations provided researchers with a comprehensive view of the operation, highlighting the broader security risks associated with private container image exposure when registries lack proper access controls.

Indicators of Compromise (IoCs): Type Indicator Description Network 45.79.183.61 C2 hub (Linode) Network 91.99.195.164 fsociety-era C2 (Hetzner) Network 213.136.79.115 Beacon / reverse shell (Contabo, ports 8080 and 4444) Network 213.136.83.197 LLM gateway (Contabo), live Network 190.211.124.187 Reverse-tunnel sink (AS262145, Costa Rica) Network carbonato-proxy-{drab,zeta,zeta-2}.vercel.app LLM proxies, suspended Network Registry fleet on AS40065 Seven endpoints, six live, withheld while live Container gh0st/, fsociety/, netd-svc, system/resolved, scrub-empty Repository names, 59 total Container GH0ST_C2, FSOCIETY_DISABLE_TUNNEL, GATEWAY_ALLOW_ALL_USERS Image environment variables Container /opt/gh0st/entry.sh, auto-persist-host.sh, SOUL.md Implant kit files Host /usr/local/bin/.docker-network-monitor Watchdog binary Host /usr/sbin/systemd-logind Miner disguised as a system service Host [kworker/u2:0] Disguised process arguments Secret carbonato125 Shared password across the archive Secret CARBONATO_API_KEY .env variable on infected hosts Telegram Chat 750752697 Deployment reports and C2 chat