A Miner Was Only the First Clue: From Docker to Hermes and AdaptixC2

A miner was only the first clue

The case began with Docker requests that looked like routine cryptomining. All four sources submitted container-create requests between the 21st and 28th of September 2026; 154[.]201[.]66[.]125 also submitted the recorded exec requests. A Monero wallet or miner-script URL linked each source. Two sources submitted host-prefixed credential searches; 154[.]201[.]66[.]125 supplied the SSH public key.

The payload URL identified a TCP/8899 server whose root exposed miner installers, exchange and wallet harvesters, a 900-worker scanner targeting TCP/9119, and an archive named hermes-internal.tgz.

Git and repository links

The archive retained a shallow Git clone whose origin pointed to hxxps://gitea[.]com/blanket/sink. Its plugin files were byte-identical to that public repository. The same account also hosted master, containing x86-64 and ARM64 AdaptixC2 Gopher agents. Its argument repository contains arg.sh, configured to pull targets from hxxp://144[.]31[.]51[.]6:8080/targets, match Hermes dashboard responses on TCP/9119, and upload matching results to a configured ProjectDiscovery Cloud account under asset name hermes.

The blanket repository set

The open-directory wide_scan.py independently scans only TCP/9119, linking the staging directory to the same Hermes discovery pipeline.

Hermes plugin and Gopher agent

The first artifact is a Hermes dashboard plugin. It registers a hidden /internal tab labelled Hemes Internal. Inside the dashboard's existing authenticated and allow-listed plugin context, its API passes commands to subprocess.run(..., shell=True) with a 30-second timeout and returns their output. A second endpoint profiles GPUs through nvidia-smi, falling back to lspci.

The second artifact is AdaptixC2 Gopher. The companion installer selects an architecture and defines commands to write the agent to /usr/local/bin/hermes-internal and enable hermes-internal.service as root. Each binary holds one authenticated AES-128-GCM profile. Both decrypt to the default Gopher watermark 0x904E5493, raw TCP without TLS, and the configured Gopher address 144[.]31[.]51[.]6:4475. The address is a static artifact value.

The retained Gopher builds provide shell, PTY, file, and process operations and TCP or SOCKS tunnelling. Their BOF handler returns Need Windows! on Linux.

Credential harvesters and miner installers

exk.py extracts credentials for 10 exchanges and signs balance requests for OKX, Bybit, Binance, and Gate using candidate keys. Other scripts search for environment files, mnemonics, Ethereum-style hexadecimal private keys, and Solana-style Base58 values. They write results to local dotfiles that defenders can preserve during scoping.

The miner installers evolved through kinst7.sh and kinst8.sh, which stage files under $HOME/.cache/uv. They write XMRig configuration, maintain watchdog loops, and attempt to display the process as kworker/u2:1.

Defensive priorities

Remove unauthenticated Docker TCP/2375 exposure and review external container-create and exec requests. Hunt both hermes-internal placements: Hermes plugin directories and /usr/local/bin/hermes-internal with its systemd unit. Search for .kwdb, .kw.json, /etc/cron.d/.sysmon, credential-harvester output files, and userland processes displayed as kernel workers. Revoke exposed exchange API keys. Move assets from exposed wallet keys or seed phrases to a newly generated wallet using a clean system. Use the Full Report's network, YARA, and host detections and typed indicators.