Hermes Agent
ThreatDown finds Hermes used after Docker compromise in CARBONATO botnet
ThreatDown says CARBONATO installs an unchanged Hermes Agent after taking over exposed Docker hosts, then supplies malicious instructions. The entry point is an unauthenticated Docker API—not a demonstrated Hermes vulnerability. Its September 22 report puts agent permissions and API-key exposure in the same incident-response frame.
ThreatDown's September 22 investigation describes an attacker-controlled deployment of Hermes Agent on already-compromised Docker hosts. The important sequence is compromise first, agent installation afterward: the report does not establish that an ordinary Hermes installation lets the botnet in. It attributes initial access and propagation to surrounding scripts, with the agent serving as an interactive interface for operator tasks. That distinction makes the defensive priority less exotic than the AI label suggests: protect the container control plane before debating the persona file.
The facts
- ThreatDown dates its collection to August 2026; the report was published September 22. - The researchers report recovering 59 repositories, 234 image tags and 605 verified blobs from an exposed registry. - The described infection path uses Docker daemons accepting unauthenticated access on port 2375. - The implant leaves the Hermes framework unchanged and replaces its persona instructions, according to the report. - The investigators separate scripted spread and persistence from the agent's Telegram-driven post-compromise tasks. - Docker documents a local Unix socket by default and SSH or authenticated TLS for remote access.
Why it matters
The operator lesson is a boundary problem, not a package blacklist. Docker's security guidance explains why daemon access is unusually powerful: the ability to create containers can include mounting the host filesystem. Container isolation therefore cannot rescue a host whose administrative API grants that capability to an intruder. The same guidance distinguishes resource controls from access controls; limiting CPU or memory does not establish who may control the engine. For an agent host, the relevant inventory includes both reachable administration endpoints and the authority exposed to workloads.
Current
This is a newly inspected September 22 threat report, not an incident confirmed on the reader's infrastructure. Its collection and infrastructure observations predate publication. Hermes now has the separate v2026.9.24 release baseline; the report does not identify that release as vulnerable or prove that an update remediates this infection path. Docker's live daemon-protection and engine-security documentation supplies the defensive baseline, independently of the botnet's chosen agent framework.
Evidence
Primary: ThreatDown — CARBONATO investigation (https://www.threatdown.com/blog/carbonato/). Supporting context: Docker — protect-access guidance (https://docs.docker.com/engine/security/protect-access/); Docker — security guidance (https://docs.docker.com/engine/security/). Source pages and available diffs were inspected; test and live-account results remain attributed to their authors, not independently repeated measurements.
Operator take
For a defensive review, distinguish an intentionally local Docker socket from a remotely reachable daemon, and verify the actual authentication boundary rather than relying on a port number alone. Docker warns that possession of its client keys can confer root-equivalent daemon authority; protect those keys accordingly. Where compromise is suspected, preserve evidence and use the established incident-response process before changing credentials or rebuilding machines. Merely uninstalling a legitimate agent would not demonstrate that host access, persistence or exposed application secrets had been addressed.
Caveat
The campaign findings are ThreatDown's, not independently reproduced here. No victim systems or attacker endpoints were probed. The inspected evidence supports abuse of a legitimate framework after host compromise, not a claim that Hermes itself is malicious or that all Hermes users are affected.
The campaign findings are ThreatDown's, not independently reproduced here. No victim systems or attacker endpoints were probed. The inspected evidence supports abuse of a legitimate framework after host compromise, not a claim that Hermes itself is malicious or that all Hermes users are affected.