ThreatDown detailed Carbonato, a botnet that targets Docker daemons exposed without authentication on port 2375 and deploys the open-source Hermes Agent AI framework. It installs the framework unchanged, then overwrites its SOUL.md persona file with a 39-line prompt directing the agent to execute tasks received over Telegram, maintain persistence, and collect credentials. On each host it launches a privileged container to run commands on the underlying system, then scans neighboring networks every five minutes to spread further, giving it worm-like propagation. Researchers found the operation through an unauthenticated Docker registry publicly accessible since May, whose staged data included details of the botnet and a separate campaign distributing trojanized cryptocurrency wallet apps.
Palo Alto Networks Unit 42 detailed a Chinese-speaking attacker who used the DeepSeek model as the reasoning engine inside an open-source agent called Hermes to attack exposed servers with little human input. Taking instructions over Telegram and using an internet asset search engine, the agent ran in a mode that executes commands without asking permission: from a single task, it downloaded a public exploit, enumerated vulnerable Langflow and n8n instances, judged targets by value, and attempted exploitation on its own. The autonomous attempts failed, blocked by authentication and configuration, though the operator succeeded manually elsewhere. The operation was exposed when the agent accidentally served its own working directory over the web.
TrustStrike Labs