# NATS-as-C2: KeyHunter Distributed Worker Botnet Harvests Cloud Credentials and AI API Keys via Langflow RCE (CVE-2026-33017)

> Sysdig Threat Research Team (TRT) disclosed a novel command-and-control technique dubbed NATS-as-C2, in which an unattributed financially-motivated actor abuses an ACL-enforced NATS pub/sub messaging server (45.192.109.25:14222) as the coordination plane for a distributed credential-harvesting botnet. The operator pivots from DigitalOcean staging host 159.89.205.184 and deploys a Python/Go worker named KeyHunter via exploitation of CVE-2026-33017 (Langflow unauthenticated RCE, CISA KEV) at /api/v1/build_public_tmp/{flow}. KeyHunter scrapes cloud development environments (CodePen, JSFiddle, StackBlitz, CodeSandbox) and public web sources for AWS access keys and LLM provider API keys (OpenAI, Anthropic, AWS Bedrock), live-validates them against vendor APIs, and reports results back to NATS C2 subjects — primarily monetized through Bedrock LLMjacking and stolen-key resale. Container-escape exploits DirtyPipe and DirtyCreds were also observed.

- **Published:** 2026-05-14T12:00:00Z
- **Last reviewed:** 2026-05-14T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0514
- **ID:** TL-2026-0514
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33017, CVE-2022-0847, CVE-2022-2588

## Description

OVERVIEW

On 2026-05-14 the Sysdig Threat Research Team (TRT) published the first documented case of an operator using NATS (a CNCF-graduated pub/sub messaging server) as a command-and-control (C2) plane for a distributed, multi-host credential-harvesting botnet. The campaign — internally tracked as the KeyHunter operation after the worker's Go module path github.com/keyhunter/worker — combines four notable elements: (1) abuse of a legitimate, ACL-enforced NATS deployment as covert C2, (2) automated exploitation of CVE-2026-33017 (Langflow unauthenticated RCE, added to CISA KEV) for initial access, (3) post-compromise harvesting of AWS keys and AI provider API keys for both LLMjacking and resale, and (4) container-escape exploitation chains (DirtyPipe, DirtyCreds) for breakout from compromised pods. Sysdig assesses the actor as financially motivated and currently unattributed.

INITIAL ACCESS — CVE-2026-33017 (LANGFLOW)

The operator scans the public IPv4 space for Langflow instances and exploits CVE-2026-33017, an unauthenticated remote code execution flaw in the /api/v1/build_public_tmp/{flow} endpoint. The endpoint accepts a flow specification that is rendered into a Jython script and executed server-side without authentication; arbitrary Python code passes directly into the runtime. The CVE was added to CISA KEV and is being actively exploited as of 2026-05-05. Sysdig's first telemetry hit (LMDeploy SSRF probes followed by Langflow exploitation) timestamps to 2026-05-05 04:13 UTC and 09:12 UTC respectively, originating from DigitalOcean IP 159.89.205.184 (the same host that subsequently served the KeyHunter staging payloads on port 8888).

POST-EXPLOITATION & STAGING

After RCE, the worker pulls four staged artifacts from http://159.89.205.184:8888/: worker-linux-amd64 (the Go-compiled worker), keyhunter_worker.py (Python orchestrator), deploy.sh (installer that drops the worker as a daemon or container), and worker.yaml (a Kubernetes manifest used when the operator detects a kubelet/API server reachable from the compromised host). Build artifact strings recovered from the binary leak Windows developer paths D:/Program Files/Go/ and /AyuGram Desktop/KeyHunter-Distributed/worker/, suggesting the operator cross-compiles from a Windows workstation. The codebase is heavily inspired by — though not identical to — the public open-source project fadidevv/keyhunter on GitHub.

NATS-AS-C2 ARCHITECTURE

The novel C2 layer is a vanilla NATS server reachable at 45.192.109.25:14222 (note: not the default NATS port 4222 — port 14222 is used to evade naive port-based detection). The operator enforces NATS subject-level ACLs so that the worker role can only publish/subscribe to a constrained set of subjects, preventing rogue subscribers from enumerating all traffic. The observed worker-role subjects are:

  task.scan_cde       — operator -> worker: scan a given CDE platform for code snippets
  task.scan_web       — operator -> worker: scrape a target URL for embedded keys
  task.validate_aws   — operator -> worker: validate an AWS access key
  task.validate_ai    — operator -> worker: validate an LLM provider API key
  heartbeat.worker    — worker -> operator: liveness beacon
  worker.hb           — worker -> operator: alternate liveness subject
  worker.heartbeat    — worker -> operator: alternate liveness subject
  workers.heartbeat   — worker -> operator: alternate liveness subject
  result.scan         — worker -> operator: scan result
  scan.result         — worker -> operator: alternate result subject
  worker.result       — worker -> operator: alternate result subject
  kh.result           — worker -> operator: KeyHunter result subject
  keyhunter.result    — worker -> operator: alternate KeyHunter result subject

The multiplicity of heartbeat/result subjects indicates iteration during development — the worker codebase contains historical naming variants. From a defender's standpoint NATS-as-C2 is attractive to the adversary because (a) the NATS protocol is a plaintext line-based protocol that resembles legitimate microservice traffic, (b) NATS message-broker traffic does not appear in typical EDR/network detection content, and (c) ACL enforcement means a passive subscriber cannot enumerate the bot population.

KEYHUNTER WORKER — CAPABILITIES

KeyHunter is multi-tenant. On task receipt it dispatches to one of four scanners:

  scan_cde     — Iterates pages of CodePen, JSFiddle, StackBlitz, and CodeSandbox via each platform's public listing/search APIs and scrapes the resulting code snippets for embedded credentials using regex packs. Pages of interest include user-pinned snippets and recently-updated public projects.

  scan_web     — Generic URL scraper for arbitrary HTTP(S) endpoints fed by the operator. Extracts both inline credentials and credentials referenced from linked JavaScript bundles.

  validate_aws — Performs live validation of AWS access keys using STS GetCallerIdentity, then probes a fixed set of services to enrich the credential record: bedrock (the primary LLMjacking target), sts, s3, ec2, ce (Cost Explorer — to gauge account value), lambda, logs, ecs, sagemaker, sso, and iam. Bedrock model listing is the explicit monetization target; SageMaker is probed for compute access; Cost Explorer is queried to pre-qualify high-spend accounts.

  validate_ai  — Live validates OpenAI, Anthropic, and AWS Bedrock keys against their respective vendor APIs with a minimal, low-cost call to confirm liveness without burning quota.

Results are JSON-serialized and published back to one of the result subjects above. The worker also emits periodic heartbeats so the operator can maintain an accurate bot count.

CONTAINER ESCAPE & PRIVILEGE ESCALATION

Where Langflow is deployed inside a container (the typical deployment topology), the worker attempts breakout using two well-known Linux kernel/cgroup primitives: DirtyPipe (CVE-2022-0847) and DirtyCreds (CVE-2022-2588 / 2022-2602 family). Successful breakout grants the operator host-level access, enabling lateral movement and credential harvesting from the host filesystem (e.g., ~/.aws/credentials, ~/.config/gcloud/credentials.db, mounted secret material).

MONETIZATION

Three paths are observed: (1) LLMjacking — abusing stolen AWS keys to run Bedrock inference on the victim's account, bypassing the actor's own LLM bill; (2) Direct resale of validated AI provider keys on credential-resale marketplaces; (3) Generalized cloud-account abuse where harvested AWS keys grant access to S3 buckets, EC2 instances, and Lambda.

ATTRIBUTION

Sysdig does not attribute the operator to a named group. Telemetry indicators (Windows build paths, AyuGram Desktop folder, references to a public Russian-speaking developer's GitHub project fadidevv/keyhunter) are circumstantial. Attribution confidence: LOW. Motivation: FINANCIAL.

DEFENSIVE GUIDANCE

Patch Langflow to the fixed release for CVE-2026-33017 immediately. Block egress to 45.192.109.25 (NATS C2) and 159.89.205.184 (staging). Deny NATS protocol egress from production workloads by default. Inspect Langflow pods for the worker artifacts listed above. Rotate any AWS or LLM provider keys that have been exposed in public CDE snippets — assume harvested.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1610 Deploy Container
- T1543 Create or Modify System Process
- T1525 Implant Internal Image
- T1611 Escape to Host
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1580 Cloud Infrastructure Discovery
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1657 Financial Theft

## Sources

- [NATS-as-C2: Inside a new technique attackers are using to harvest cloud credentials and AI API keys](https://sysdig.com/blog/nats-as-c2-inside-a-new-technique-attackers-are-using-to-harvest-cloud-credentials-and-ai-api-keys)
- [CISA KEV — CVE-2026-33017 (Langflow unauthenticated RCE)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD entry — CVE-2026-33017](https://nvd.nist.gov/vuln/detail/CVE-2026-33017)
- [NATS.io — Authorization and ACLs](https://docs.nats.io/running-a-nats-service/configuration/securing_nats/authorization)
- [fadidevv/keyhunter — public open-source antecedent](https://github.com/fadidevv/keyhunter)
- [Sysdig — LLMjacking: stolen cloud credentials used in new AI attack](https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack)
- [CVE-2022-0847 (DirtyPipe)](https://nvd.nist.gov/vuln/detail/CVE-2022-0847)
- [CVE-2022-2588 (DirtyCreds family)](https://nvd.nist.gov/vuln/detail/CVE-2022-2588)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0514