OVERVIEW

On 2026-05-14 the Sysdig Threat Research Team (TRT) published the first documented case of an operator using NATS (a CNCF-graduated pub/sub messaging server) as a command-and-control (C2) plane for a distributed, multi-host credential-harvesting botnet. The campaign — internally tracked as the KeyHunter operation after the worker's Go module path github.com/keyhunter/worker — combines four notable elements: (1) abuse of a legitimate, ACL-enforced NATS deployment as covert C2, (2) automated exploitation of CVE-2026-33017 (Langflow unauthenticated RCE, added to CISA KEV) for initial access, (3) post-compromise harvesting of AWS keys and AI provider API keys for both LLMjacking and resale, and (4) container-escape exploitation chains (DirtyPipe, DirtyCreds) for breakout from compromised pods. Sysdig assesses the actor as financially motivated and currently unattributed.

INITIAL ACCESS — CVE-2026-33017 (LANGFLOW)

The operator scans the public IPv4 space for Langflow instances and exploits CVE-2026-33017, an unauthenticated remote code execution flaw in the /api/v1/build_public_tmp/{flow} endpoint. The endpoint accepts a flow specification that is rendered into a Jython script and executed server-side without authentication; arbitrary Python code passes directly into the runtime. The CVE was added to CISA KEV and is being actively exploited as of 2026-05-05. Sysdig's first telemetry hit (LMDeploy SSRF probes followed by Langflow exploitation) timestamps to 2026-05-05 04:13 UTC and 09:12 UTC respectively, originating from DigitalOcean IP 159.89.205.184 (the same host that subsequently served the KeyHunter staging payloads on port 8888).

POST-EXPLOITATION & STAGING

After RCE, the worker pulls four staged artifacts from http://159.89.205.184:8888/: worker-linux-amd64 (the Go-compiled worker), keyhunter_worker.py (Python orchestrator), deploy.sh (installer that drops the worker as a daemon or container), and worker.yaml (a Kubernetes manifest used when the operator detects a kubelet/API server reachable from the compromised host). Build artifact strings recovered from the binary leak Windows developer paths D:/Program Files/Go/ and /AyuGram Desktop/KeyHunter-Distributed/worker/, suggesting the operator cross-compiles from a Windows workstation. The codebase is heavily inspired by — though not identical to — the public open-source project fadidevv/keyhunter on GitHub.

NATS-AS-C2 ARCHITECTURE

The novel C2 layer is a vanilla NATS server reachable at 45.192.109.25:14222 (note: not the default NATS port 4222 — port 14222 is used to evade naive port-based detection). The operator enforces NATS subject-level ACLs so that the worker role can only publish/subscribe to a constrained set of subjects, preventing rogue subscribers from enumerating all traffic. The observed worker-role subjects are:

task.scan_cde — operator -> worker: scan a given CDE platform for code snippets task.scan_web — operator -> worker: scrape a target URL for embedded keys task.validate_aws — operator -> worker: validate an AWS access key task.validate_ai — operator -> worker: validate an LLM provider API key heartbeat.worker — worker -> operator: liveness beacon worker.hb — worker -> operator: alternate liveness subject worker.heartbeat — worker -> operator: alternate liveness subject workers.heartbeat — worker -> operator: alternate liveness subject result.scan — worker -> operator: scan result scan.result — worker -> operator: alternate result subject worker.result — worker -> operator: alternate result subject kh.result — worker -> operator: KeyHunter result subject keyhunter.result — worker -> operator: alternate KeyHunter result subject

The multiplicity of heartbeat/result subjects indicates iteration during development — the worker codebase contains historical naming variants. From a defender's standpoint NATS-as-C2 is attractive to the adversary because (a) the NATS protocol is a plaintext line-based protocol that resembles legitimate microservice traffic, (b) NATS message-broker traffic does not appear in typical EDR/network detection content, and (c) ACL enforcement means a passive subscriber cannot enumerate the bot population.

KEYHUNTER WORKER — CAPABILITIES

KeyHunter is multi-tenant. On task receipt it dispatches to one of four scanners:

scan_cde — Iterates pages of CodePen, JSFiddle, StackBlitz, and CodeSandbox via each platform's public listing/search APIs and scrapes the resulting code snippets for embedded credentials using regex packs. Pages of interest include user-pinned snippets and recently-updated public projects.

scan_web — Generic URL scraper for arbitrary HTTP(S) endpoints fed by the operator. Extracts both inline credentials and credentials referenced from linked JavaScript bundles.

validate_aws — Performs live validation of AWS access keys using STS GetCallerIdentity, then probes a fixed set of services to enrich the credential record: bedrock (the primary LLMjacking target), sts, s3, ec2, ce (Cost Explorer — to gauge account value), lambda, logs, ecs, sagemaker, sso, and iam. Bedrock model listing is the explicit monetization target; SageMaker is probed for compute access; Cost Explorer is queried to pre-qualify high-spend accounts.

validate_ai — Live validates OpenAI, Anthropic, and AWS Bedrock keys against their respective vendor APIs with a minimal, low-cost call to confirm liveness without burning quota.

Results are JSON-serialized and published back to one of the result subjects above. The worker also emits periodic heartbeats so the operator can maintain an accurate bot count.

CONTAINER ESCAPE & PRIVILEGE ESCALATION

Where Langflow is deployed inside a container (the typical deployment topology), the worker attempts breakout using two well-known Linux kernel/cgroup primitives: DirtyPipe (CVE-2022-0847) and DirtyCreds (CVE-2022-2588 / 2022-2602 family). Successful breakout grants the operator host-level access, enabling lateral movement and credential harvesting from the host filesystem (e.g., ~/.aws/credentials, ~/.config/gcloud/credentials.db, mounted secret material).

MONETIZATION

Three paths are observed: (1) LLMjacking — abusing stolen AWS keys to run Bedrock inference on the victim's account, bypassing the actor's own LLM bill; (2) Direct resale of validated AI provider keys on credential-resale marketplaces; (3) Generalized cloud-account abuse where harvested AWS keys grant access to S3 buckets, EC2 instances, and Lambda.

ATTRIBUTION

Sysdig does not attribute the operator to a named group. Telemetry indicators (Windows build paths, AyuGram Desktop folder, references to a public Russian-speaking developer's GitHub project fadidevv/keyhunter) are circumstantial. Attribution confidence: LOW. Motivation: FINANCIAL.

DEFENSIVE GUIDANCE

Patch Langflow to the fixed release for CVE-2026-33017 immediately. Block egress to 45.192.109.25 (NATS C2) and 159.89.205.184 (staging). Deny NATS protocol egress from production workloads by default. Inspect Langflow pods for the worker artifacts listed above. Rotate any AWS or LLM provider keys that have been exposed in public CDE snippets — assume harvested.