# NadMesh Botnet Hunts Exposed AI Services (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) for Credentials and MCP Tool Access

> QiAnXin XLab uncovered NadMesh, a Go-based, Garble/UPX-packed botnet with 20+ RCE vectors (Docker API, Jenkins, Redis, Kubernetes, Spring Cloud Gateway, Struts, Marimo, rclone, and more) that specifically hunts self-hosted AI infrastructure — ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — via Shodan-driven high-priority scanning to harvest AWS/cloud credentials, Kubernetes service-account tokens, Docker configs, and MCP tool access.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-26T12:28:12.778Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1455
- **ID:** TL-2026-1455
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-39987, CVE-2026-41176, CVE-2022-22947, CVE-2017-12611, CVE-2016-0638

## Description

NadMesh (named for a 'n4d mesh controller' string found in its source) is a continuously-iterated, Go-based botnet identified by QiAnXin's XLab team in early July 2026. Unlike commodity IoT/DDoS botnets, NadMesh is purpose-built as a credential- and intelligence-harvesting platform targeting the rapidly-expanding, often carelessly-exposed self-hosted AI tooling ecosystem: ComfyUI (port 8188), Ollama (11434), n8n (5678), Open WebUI, Langflow, and Gradio (7860). The operator maintains an autonomous scanning engine seeded with 90+ cloud-provider CIDR ranges and a 30-port probe list, and integrates Shodan queries (via an `ai_harvest.py` helper) that inject discovered AI-service IPs as priority=20 scan tasks — second only to priority=50 rescans of already-confirmed-vulnerable hosts.

Exploitation is delivered through more than 20 distinct vectors, dominated by Docker API RCE on port 2375 (30.31% of observed exploitation traffic), Jenkins script-console RCE (22.28%), weak Telnet credentials (10.36%), and Redis CONFIG SET/SAVE-based file-write RCE (8.29%), rounded out by Kubernetes pod-creation/hostPath-mount escapes, Elasticsearch scripting RCE, Spring Cloud Gateway Actuator expression injection (CVE-2022-22947), Apache Struts Freemarker RCE (CVE-2017-12611), Marimo unauthenticated terminal WebSocket RCE (CVE-2026-39987), rclone RC authentication-bypass (CVE-2026-41176), WebLogic deserialization, and code-server/Airflow/Superset/XXL-Job API abuse. A dedicated MCP JSON-RPC `execute_command` vector accounts for only 0.78% of raw traffic but is explicitly prioritized by the controller as a strategic target because it grants direct arbitrary command execution on any exposed Model Context Protocol tool server.

Once a host is compromised, the agent harvests AWS_ACCESS_KEY_ID/secret pairs and Bedrock API credentials from environment variables and `~/.aws/config`, Kubernetes ServiceAccount tokens (including cluster-admin scoped tokens), Docker daemon status and `~/.docker/config.json` credentials, arbitrary `.env` file contents, SSH session tokens, and — uniquely — an inventory of locally available AI models (e.g., installed Ollama models, configured OpenAI-compatible keys) and any MCP tools exposed by the host, each tagged with an automated exploitability assessment. The operator's own dashboard claims 3,811 unique harvested AWS keys.

Persistence is triple-redundant: SSH backdoor via `.ssh/authorized_keys` injection, dropped payload copies at `/dev/shm/.a`, `/var/tmp/.a`, and `/tmp/.a`, and cron watchdogs at `/etc/cron.d/.sys_monitor` and `/etc/cron.d/.s`. Every build is individually obfuscated with Garble (symbol/literal rewriting) and packed with UPX -9 plus random padding, producing a unique hash per binary to defeat static signature detection. The controller (available in functionally-identical Go and Python implementations) listens on ports 80/8443 behind spoofed nginx response headers, authenticates bots via HMAC-SHA256 with a ±60 second timestamp window, authenticates operators via an `X-Operator-Key` header, and protects the management panel with hourly-rotating SHA-256 session cookies. Backend state uses an in-memory hot path (sync.Map + channels + ring buffers) asynchronously flushed to PostgreSQL every 30 seconds. The operator runs supporting automation scripts — `yield_generator.py` (amplifies top-50 high-yield /16 subnets every 5 minutes), `auto_inject.sh` (rescans confirmed-dangerous IPs every 15 minutes at priority=20), `reinject.sh` (full 7-day rescan at priority=50), and `auto_blacklist.sh` (hourly honeypot detection — any target absorbing 10+ failed deployment attempts without ever returning a result is automatically blacklisted as a suspected honeypot). A canary/A/B rollout endpoint (`/api/update/canary`) had served 5,448 canary responses versus 84,024 null responses at time of analysis, and observable 'conversion funnel' statistics (success / exploit_sent / failed / intel) across the panel suggest a commercial, ROI-tracked operation rather than vandalism.

Distinct source IPs distributing NadMesh grew from near-zero in late June 2026 to roughly 139 per day by the first week of July 2026. XLab identified five concurrent active build versions, including builds tagged 33.8-GO-TITAN and 30.0, indicating active, ongoing development. No formal threat-actor attribution has been established; XLab characterizes the operation's dashboarding and funnel-tracking behavior as reflecting a 'product-grade' commercial mindset.

## MITRE ATT&CK

- T1595.001 Active Scanning: Scanning IP Blocks
- T1596 Search Open Technical Databases
- T1587.001 Develop Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1583.004 Acquire Infrastructure: Server
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1609 Container Administration Command
- T1053.003 Scheduled Task/Job: Cron
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1505 Server Software Component
- T1611 Escape to Host
- T1078.004 Valid Accounts: Cloud Accounts
- T1027.002 Obfuscated Files or Information: Software Packing
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1528 Steal Application Access Token
- T1110.001 Brute Force: Password Guessing
- T1082 System Information Discovery
- T1526 Cloud Service Discovery
- T1613 Container and Resource Discovery
- T1046 Network Service Discovery
- T1021.004 Remote Services: SSH
- T1119 Automated Collection
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1596.005 Search Open Technical Databases: Scan Databases
- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1059.006 Command and Scripting Interpreter: Python
- T1610 Deploy Container
- T1651 Cloud Administration Command

## Sources

- [New NadMesh Botnet Hunts Exposed AI Services for Credentials, MCP Tool Access](https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html)
- [NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era](https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era-en/)
- [NadMesh Botnet Targets AI and MCP Servers With 20+ Remote Code Execution Vectors](https://cyberpress.org/nadmesh-targets-ai-servers/)
- [Langflow Flaw Exploited to Steal AWS Keys and Deploy Botnet](https://sqmagazine.co.uk/langflow-flaw-exploited-aws-keys/)
- [NVD - CVE-2026-39987](https://nvd.nist.gov/vuln/detail/CVE-2026-39987)
- [NVD - CVE-2026-41176](https://nvd.nist.gov/vuln/detail/CVE-2026-41176)
- [NVD - CVE-2022-22947](https://nvd.nist.gov/vuln/detail/CVE-2022-22947)
- [NVD - CVE-2017-12611](https://nvd.nist.gov/vuln/detail/CVE-2017-12611)
- [CISA Known Exploited Vulnerabilities Catalog - Marimo RCE (CVE-2026-39987)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1455