news.mlab.sh
Back to the feed
threat-intel

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Jul 17, 2026 · The Hacker News · [email protected] (The Hacker News)
High
Summary

A Go botnet called NadMesh is actively targeting exposed AI services and cloud infrastructure, specifically seeking AWS keys, Kubernetes tokens, and Docker API access. The botnet, discovered by XLab and previously identified by Censys, uses a sophisticated scanning and exploitation strategy, leveraging tools like MCP to gain access to sensitive resources. Researchers have observed a significant increase in NadMesh's activity since April, with a broader scope than previous campaigns, focusing on logging capabilities rather than just GPU mining. The botnet employs obfuscation and persistence techniques to evade detection and maintain access.

A Go botnet, NadMesh, has emerged in early July, aggressively hunting exposed AI services and cloud infrastructure. The operator's dashboard claims 3,811 unique AWS keys, and XLab’s research indicates 47 credential hauls and 41 model inventories in the last 100 records, suggesting a reach beyond the immediate host. The botnet scans for exposed services like ComfyUI, Ollama, n8n, Gradio, and Open WebUI, which are commonly deployed for image generation and workflow building.

NadMesh utilizes the MCP (Multi-Cloud Platform) controller, prioritizing exploitation of Docker APIs, Kubernetes, and Redis. MCP’s authentication is designed to bypass core protocols, and many deployments skip the authorization flow. The botnet scans for exposed services and admin functionality, including an open Docker API on 2375, a Jenkins script console, and unauthenticated Redis.

Researchers have observed a significant increase in NadMesh’s activity since April, with a broader scope than previous campaigns, focusing on logging capabilities rather than just GPU mining. The botnet employs obfuscation and persistence techniques to evade detection and maintain access. The scanning feeds itself, resampled more densely for hits and rescanning dangerous IPs every quarter hour.

Key vulnerabilities include CVE-2026-39987 (Marimo notebooks), CVE-2026-41176 (rclone RC servers), and CVE-2022-22947 (Spring Cloud Gateway Actuator). XLab’s research indicates that the botnet’s exploit traffic heavily targets Docker sockets and Jenkins consoles.

Recent activity mirrors a previous campaign by Censys, which identified a similar operator exploiting exposed ComfyUI for GPU, Monero, and Conflux mining, alongside a Hysteria proxy node. The key difference is NadMesh’s focus on logging capabilities, seeking to gain access to host logs and administrative privileges.

**What to do:**

  • Secure exposed Docker APIs (port 2375), Jenkins consoles, and unauthenticated Redis.
  • Review and revoke SSH keys stored in ~/.ssh/authorized_keys, /dev/shm/.a, /var/tmp/.a, /tmp/.a, and /etc/cron.d/.sys_monitor, /etc/cron.d/.s.
  • Isolate affected hosts and revoke all credentials found.
  • Monitor for C2 at 209.99.186[.]235 and domain cdnorigin[.]net.

**If You Run Any of This:**

  • The botnet uses obfuscation (Garble, UPX) and random padding to avoid hash detection.
  • The operator’s scoreboard excludes successful outcomes, focusing on logging capabilities.

**Companies:**

  • AWS
  • Censys
  • Hysteria
  • Monero
  • Conflux

**Threat Actors:**

  • Unknown

**Malware:**

  • MCP (Multi-Cloud Platform)
  • Hysteria

**Sectors:**

  • Cloud Computing
  • Artificial Intelligence

**Countries:**

  • N/A

**Products:**

  • AWS
  • ComfyUI
  • Ollama
  • n8n
  • Gradio
  • Open WebUI
  • Docker
  • Jenkins
  • Redis
  • rclone

**Tags:**

  • botnet
  • cloud-security
  • docker
  • kubernetes
  • credential-harvesting
  • log-scraping
Read the full article at The Hacker News