Affected Systems
Docker daemons exposed without authentication on TCP port 2375. All versions of Docker with unauthenticated remote API access are vulnerable. The malware deploys Hermes AI Agent framework and establishes Telegram-based command and control. Worm-like propagation across networks with exposed Docker instances.
Exploitation Status
Active exploitation confirmed since May 2026. ThreatDown discovered an unauthenticated Docker registry publicly accessible since May 2026 containing staged botnet data. Multiple related AI-enabled campaigns observed targeting government and retail sectors since July 2026.
Business Impact
Compromised Docker hosts grant attackers privileged container access to underlying systems. Threat actors establish persistent remote access via reverse SSH tunnels and cron jobs. AI agent autonomously executes commands received via Telegram without human oversight, enabling credential theft, lateral movement, and sustained network presence. Operators based in Costa Rica per infrastructure analysis. Evasion techniques include masquerading as system components and watchdog scripts for persistence.
Urgency
🔴 Immediate
Recommended Actions
- Immediately audit all Docker daemon instances and disable unauthenticated remote API access on TCP port 2375; enforce TLS authentication for Docker API endpoints
- Scan networks for unauthorized privileged containers and reverse SSH tunnels to Costa Rica-based infrastructure; check cron jobs and systemd units for persistence mechanisms
- Monitor outbound Telegram API connections from Docker hosts and container environments; block unauthorized Telegram bot traffic at network perimeter
- Search Docker registries and container images for Hermes Agent framework installations and modified SOUL.md persona files referencing GH0ST or Telegram command loops
- Implement network segmentation to prevent Docker hosts from scanning adjacent subnets; restrict container network policies to prevent lateral movement