NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access

NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama (TL-2026-1455), also tracked as n4d mesh controller, is a high-severity malware campaign scored CVSS 9.8, first published 2026-07-17 and last reviewed 2026-07-26. It has no confirmed attribution, affects marimo-team marimo, references 5 CVEs (CVE-2026-39987, CVE-2026-41176, CVE-2022-22947), maps to 50 MITRE ATT&CK techniques (T1005, T1021.004, T1027), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-1455

Threat ID
TL-2026-1455
Also known as
n4d mesh controller
Severity
HIGH
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
MALWARE
First published
2026-07-17
Last reviewed
2026-07-26
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, cloud-services, ai-ml-operators, managed-service-providers
Target regions
Global
Detection rules
9
Indicators of compromise
31
Updates
2026-07-26 · 2 updates · revalidated 2× · latest source

Malware and tooling in NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

Malware and tooling: NadMesh, Garble, UPX

QiAnXin XLab uncovered NadMesh, a Go-based, Garble/UPX-packed botnet with 20+ RCE vectors (Docker API, Jenkins, Redis, Kubernetes, Spring Cloud Gateway, Struts, Marimo, rclone, and more) that specifically hunts self-hosted AI infrastructure — ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — via Shodan-driven high-priority scanning to harvest AWS/cloud credentials, Kubernetes service-account tokens, Docker configs, and MCP tool access.

How NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama works

NadMesh (named for a 'n4d mesh controller' string found in its source) is a continuously-iterated, Go-based botnet identified by QiAnXin's XLab team in early July 2026. Unlike commodity IoT/DDoS botnets, NadMesh is purpose-built as a credential- and intelligence-harvesting platform targeting the rapidly-expanding, often carelessly-exposed self-hosted AI tooling ecosystem: ComfyUI (port 8188), Ollama (11434), n8n (5678), Open WebUI, Langflow, and Gradio (7860). The operator maintains an autonomous scanning engine seeded with 90+ cloud-provider CIDR ranges and a 30-port probe list, and integrates Shodan queries (via an `ai_harvest.py` helper) that inject discovered AI-service IPs as priority=20 scan tasks — second only to priority=50 rescans of already-confirmed-vulnerable hosts.

Exploitation is delivered through more than 20 distinct vectors, dominated by Docker API RCE on port 2375 (30.31% of observed exploitation traffic), Jenkins script-console RCE (22.28%), weak Telnet credentials (10.36%), and Redis CONFIG SET/SAVE-based file-write RCE (8.29%), rounded out by Kubernetes pod-creation/hostPath-mount escapes, Elasticsearch scripting RCE, Spring Cloud Gateway Actuator expression injection (CVE-2022-22947), Apache Struts Freemarker RCE (CVE-2017-12611), Marimo unauthenticated terminal WebSocket RCE (CVE-2026-39987), rclone RC authentication-bypass (CVE-2026-41176), WebLogic deserialization, and code-server/Airflow/Superset/XXL-Job API abuse. A dedicated MCP JSON-RPC `execute_command` vector accounts for only 0.78% of raw traffic but is explicitly prioritized by the controller as a strategic target because it grants direct arbitrary command execution on any exposed Model Context Protocol tool server.

Once a host is compromised, the agent harvests AWS_ACCESS_KEY_ID/secret pairs and Bedrock API credentials from environment variables and `~/.aws/config`, Kubernetes ServiceAccount tokens (including cluster-admin scoped tokens), Docker daemon status and `~/.docker/config.json` credentials, arbitrary `.env` file contents, SSH session tokens, and — uniquely — an inventory of locally available AI models (e.g., installed Ollama models, configured OpenAI-compatible keys) and any MCP tools exposed by the host, each tagged with an automated exploitability assessment. The operator's own dashboard claims 3,811 unique harvested AWS keys.

Persistence is triple-redundant: SSH backdoor via `.ssh/authorized_keys` injection, dropped payload copies at `/dev/shm/.a`, `/var/tmp/.a`, and `/tmp/.a`, and cron watchdogs at `/etc/cron.d/.sys_monitor` and `/etc/cron.d/.s`. Every build is individually obfuscated with Garble (symbol/literal rewriting) and packed with UPX -9 plus random padding, producing a unique hash per binary to defeat static signature detection. The controller (available in functionally-identical Go and Python implementations) listens on ports 80/8443 behind spoofed nginx response headers, authenticates bots via HMAC-SHA256 with a ±60 second timestamp window, authenticates operators via an `X-Operator-Key` header, and protects the management panel with hourly-rotating SHA-256 session cookies. Backend state uses an in-memory hot path (sync.Map + channels + ring buffers) asynchronously flushed to PostgreSQL every 30 seconds. The operator runs supporting automation scripts — `yield_generator.py` (amplifies top-50 high-yield /16 subnets every 5 minutes), `auto_inject.sh` (rescans confirmed-dangerous IPs every 15 minutes at priority=20), `reinject.sh` (full 7-day rescan at priority=50), and `auto_blacklist.sh` (hourly honeypot detection — any target absorbing 10+ failed deployment attempts without ever returning a result is automatically blacklisted as a suspected honeypot). A canary/A/B rollout endpoint (`/api/update/canary`) had served 5,448 canary responses versus 84,024 null responses at time of analysis, and observable 'conversion funnel' statistics (success / exploit_sent / failed / intel) across the panel suggest a commercial, ROI-tracked operation rather than vandalism.

Distinct source IPs distributing NadMesh grew from near-zero in late June 2026 to roughly 139 per day by the first week of July 2026. XLab identified five concurrent active build versions, including builds tagged 33.8-GO-TITAN and 30.0, indicating active, ongoing development. No formal threat-actor attribution has been established; XLab characterizes the operation's dashboarding and funnel-tracking behavior as reflecting a 'product-grade' commercial mindset.

MITRE ATT&CK techniques used in TL-2026-1455

Collection

T1005 Data from Local System; T1119 Automated Collection

Lateral Movement

T1021.004 Remote Services: SSH; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036 Masquerading; T1497 Virtualization/Sandbox Evasion; T1564.001 Hide Artifacts: Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery; T1613 Container and Resource Discovery

Persistence

T1053.003 Scheduled Task/Job: Cron; T1098.004 Account Manipulation: SSH Authorized Keys; T1505 Server Software Component; T1554 Compromise Host Software Binary

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1609 Container Administration Command; T1610 Deploy Container; T1651 Cloud Administration Command

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.004 Valid Accounts: Cloud Accounts; T1611 Escape to Host

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Credential Access

T1110 Brute Force; T1110.001 Brute Force: Password Guessing; T1528 Steal Application Access Token; T1552.001 Unsecured Credentials: Credentials In Files; T1552.007 Unsecured Credentials: Container API

Impact

T1496 Resource Hijacking

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1583.004 Acquire Infrastructure: Server; T1583.006 Acquire Infrastructure: Web Services; T1587.001 Develop Capabilities: Malware; T1588.002 Obtain Capabilities: Tool

Reconnaissance

T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1595.001 Active Scanning: Scanning IP Blocks; T1596 Search Open Technical Databases; T1596.005 Search Open Technical Databases: Scan Databases

Affected products and versions in NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

  • marimo-team — marimo
    Vulnerable versions: < 0.23.0
    Fixed in: >= 0.23.0
  • Rclone — rclone
    Vulnerable versions: 1.45.0 - 1.73.4
    Fixed in: >= 1.73.5
  • VMware/Spring — Spring Cloud Gateway
    Vulnerable versions: 3.0.x < 3.0.7; 3.1.x < 3.1.1; all older unsupported versions
    Fixed in: >= 3.0.7; >= 3.1.1
  • Apache — Struts
    Vulnerable versions: 2.0.0 - 2.3.33; 2.5 - 2.5.10.1
    Fixed in: upgrade required
  • Docker — Docker Engine API
    Vulnerable versions: unauthenticated API exposed on port 2375/2376
    Fixed in: N/A - configuration issue
  • Various — ComfyUI / Ollama / n8n / Open WebUI / Langflow / Gradio
    Vulnerable versions: default/unauthenticated internet-exposed deployments
    Fixed in: N/A - configuration issue

Remediation for NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

Patches

  • marimo >= 0.23.0 (CVE-2026-39987)
  • rclone >= 1.73.5 (CVE-2026-41176)
  • Spring Cloud Gateway >= 3.1.1 / >= 3.0.7 (CVE-2022-22947)
  • Apache Struts upgrade beyond 2.5.10.1 with Freemarker tag remediation (CVE-2017-12611)

Immediate actions

  • Take ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances off the public internet or place them behind authenticated reverse proxies / VPN
  • Block egress/ingress to C2 IP 209.99.186.235 and domain cdnorigin.net at perimeter firewalls and DNS resolvers
  • Disable or authenticate the Docker Engine API (port 2375/2376) — never expose it unauthenticated to the internet
  • Disable the Jenkins script console for unauthenticated/low-privilege users; enforce RBAC and CSRF protection
  • Patch Marimo to >= 0.23.0 (CVE-2026-39987) and rclone to >= 1.73.5 (CVE-2026-41176) immediately
  • Rotate any AWS keys, Kubernetes ServiceAccount tokens, and Docker registry credentials that may have been exposed on internet-facing hosts
  • Audit ~/.ssh/authorized_keys, /etc/cron.d/.sys_monitor, /etc/cron.d/.s, and /dev/shm/.a, /var/tmp/.a, /tmp/.a for signs of compromise

Workarounds

  • Disable the Spring Cloud Gateway Actuator Gateway endpoint if patching is not immediately possible
  • Restrict Redis to localhost/authenticated access and disable CONFIG SET/SAVE for untrusted clients
  • Enforce strong, unique Telnet/SSH credentials and disable Telnet entirely where feasible

Longer-term hardening

  • Require authentication on all MCP JSON-RPC tool servers and disable/allowlist execute_command-style tools by default
  • Implement network segmentation and egress filtering for hosts running self-hosted AI/ML tooling
  • Deploy EDR/behavioral monitoring for anomalous cron modification, SSH authorized_keys writes, and container escape indicators
  • Adopt least-privilege IAM for cloud credentials distributed to AI/ML workloads; use short-lived tokens instead of static AWS keys
  • Establish an internet-exposure inventory/ASM process specifically covering rapidly-deployed AI tooling

CVEs associated with NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

CVE-2026-39987, CVE-2026-41176, CVE-2022-22947, CVE-2017-12611, CVE-2016-0638

Weaknesses (CWE) in NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

CWE-306, CWE-15, CWE-917, CWE-94, CWE-20, CWE-287, CWE-502, CWE-284, CWE-798

Timeline of NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

  • Marimo pre-auth RCE (CVE-2026-39987, GHSA-2679-6mx9-h9xc) publicly disclosed; exploitation attempts observed within ~9h41m of disclosure, later folded into NadMesh's vector set.
  • CVE-2026-39987 (Marimo unauthenticated terminal WebSocket RCE) confirmed under active exploitation and added to CISA's Known Exploited Vulnerabilities catalog, later folded into NadMesh's vector set.
  • Censys telemetry documents 12,520 publicly reachable MCP services (~90 advertising dangerous execute_command-class tools) — the exposed surface NadMesh's Shodan-driven ai_harvest.py targets.
  • CVE-2026-41176, an rclone RC authentication-bypass vulnerability (options/set rc.NoAuth=true), disclosed and patched in rclone 1.73.5 — subsequently weaponized by NadMesh.
  • Distinct source IPs distributing the NadMesh agent begin rising from near-zero, per XLab's distribution telemetry.
  • Related reporting describes a Langflow-flaw campaign stealing AWS keys and deploying botnet payloads, consistent with NadMesh's AI-service targeting pattern.
  • Distinct source IPs distributing NadMesh reach approximately 139 per day, up from near-zero roughly a week earlier.
  • Researchers capture a snapshot of the NadMesh operator panel (/panel/) showing an operator-claimed 3,811 unique harvested AWS keys.
  • Cyberpress publishes a technical breakdown confirming 20+ RCE vectors and MCP/AI-server targeting.
  • QiAnXin's XLab publishes 'NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era,' detailing the botnet's controller architecture, exploitation vectors, and AI/MCP targeting.
  • Wiz Threat Research publishes 'NadMesh: Autonomous AI-Focused Botnet Targeting Cloud and AI Infrastructure,' the first independent incident report corroborating XLab's findings and adding CVE-2016-0638 (WebLogic deserialization) to the exploitation set.
  • The Hacker News publishes coverage summarizing NadMesh's targeting of ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio, and the operator's claimed 3,811 harvested unique AWS keys.
  • Cyber Security News publishes follow-up coverage detailing NadMesh's Shodan-driven targeting of AI/MCP infrastructure and the operator's inconsistent dashboard statistics.
  • CISA KEV catalog (2026-07-24 release, 1,653 entries) checked; none of NadMesh's five exploited CVEs currently appear in KEV — exploitation is tracked only via vendor/independent telemetry.

Update history for TL-2026-1455

Sources cited for NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

Threats related to NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama

Detection coverage for TL-2026-1455

As of 2026-07-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1455 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1455

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats