Carbonato Botnet Uses Hermes Agent to Control Exposed Docker Hosts

ThreatDown researchers have detailed Carbonato, a Docker botnet that compromises unauthenticated Docker daemons and installs the open-source Hermes Agent framework as a Telegram-controlled post-compromise interface. The case is notable because Hermes Agent is left unchanged; the malicious behavior comes from a replaced SOUL.md persona file and supporting persistence scripts.