NadMesh Botnet Is Raiding Exposed AI Services for Cloud Keys, and the Numbers Don't Add Up
A Go-based botnet called NadMesh surfaced in early July with a fairly focused agenda: find exposed AI services, grab whatever cloud credentials are lying around, and move on. The operator's own dashboard, screenshotted by Chinese threat intelligence firm QiAnXin XLab on July 10, claims 3,811 unique AWS keys collected. Whether that number is accurate is another question entirely.
XLab named the malware after a string in its source code, "n4d mesh controller", and published their findings last Friday. The botnet feeds itself with a Shodan harvester that keeps a scan queue populated with targets including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. In other words: the AI tools that engineering teams spin up quickly and lock down slowly, if ever.
The panel's own statistics are openly contradictory. A counter showing 17,700 total deployments sits next to a funnel claiming 95,700 in the past 24 hours. One tile shows 16 active bots; the adjacent tile shows 12. The credential count at least appears twice and agrees with itself. XLab's external sensor data tells a more coherent story: distinct source IPs pushing NadMesh were near zero through late June, then spiked sharply in the first week of July, peaking around 139 per day.
What the bots actually collect is straightforward. They pull cloud keys from environment variables, harvest Kubernetes service account tokens, and exfiltrate the contents of ~/.aws/config, .env files, and ~/.docker/config.json. The researchers are blunt about the motivation: the operator wants credentials and cluster access, not the compromised host itself. Model access tokens and callable MCP tools are also on the list.
MCP sits at the top of the controller's exploitation priority order, above Kubernetes, Docker API, and Redis. The recorded attack vector is a JSON-RPC tools/call to execute_command. No CVE is associated with this. MCP's original specification deliberately left authentication outside the core protocol, and the authorization flow added in March 2025 remains optional. Plenty of deployments skip it entirely.
Censys counted 12,520 publicly reachable MCP services across 8,758 IP addresses as of late April. That grew to over 21,000 by early May, with roughly 90 advertising a command execution tool. Thirty-nine of those had a tool named execute_command specifically, which is precisely the call NadMesh targets.
Despite the MCP hype in the panel's own counters (12,100 services listed as exploitable, 21 MCP vulnerabilities overall), XLab's actual observed traffic tells a different story. Docker container API exploitation accounts for 30.31% of captured attempts. Jenkins script console RCE takes another 22.28%. Telnet weak credentials sit at 10.36%, Redis at 8.29%. mcp_cmd_execute does appear in the traffic breakdown, but at 0.78%, buried in the unlabeled tail. The AI targeting is real at the intake and in the loot. Most of the actual exploit attempts still go to Docker sockets and Jenkins.
The scanning logic is self-reinforcing. Subnets that produce hits get resampled every five minutes. IPs flagged as active in the last 24 hours get rescanned every 15 minutes as /32 queries, with AI service ports checked first. Any target that absorbs ten deployment attempts without responding gets auto-blacklisted as a suspected honeypot, which XLab reads as a sign the operator is aware researchers are watching. If the queue runs dry, bots generate a random /24 subnet and continue.
Five build versions run simultaneously. Every build goes through Garble obfuscation, UPX -9 packing, and random padding. No two agents share a hash. The published sample hash catches that one build and nothing else.
Persistence is designed to survive partial removal, with three concurrent mechanisms so pulling one leaves the others to reinstall it. There is a canary endpoint staging new builds to a subset of the fleet before wider rollout.
Perhaps the most revealing detail is in the panel's footnote: success is scored using an allowlist that explicitly excludes Ollama harvests and AWS credential grabs from the count. The operator's own scoreboard does not count the primary thing the operator is taking.
If you run any of this stack
Most of what NadMesh exploits is exposed admin functionality: an open Docker API on port 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, SSH with guessable passwords. None of these require a patch. They require authentication or removal from the public internet.
The rescan job prioritises four ports: 8188 (ComfyUI), 11434 (Ollama), 7860 (Gradio), and 5678 (n8n). Start there.
There is also a patch queue worth checking. CVE-2026-39987 is a pre-auth RCE in Marimo notebooks before version 0.23.0, added to CISA's Known Exploited Vulnerabilities catalogue in April after it was actively exploited within hours of disclosure. CVE-2026-41176 allows an unauthenticated caller to disable authentication on rclone RC servers from version 1.45.0 through 1.73.5 if they were started without HTTP auth enabled. Given that rclone configs are effectively cloud credential stores, that one warrants attention.
Older entries need context before triggering alarm. CVE-2022-22947, appearing in 6.48% of observed exploit traffic, only affects Spring Cloud Gateway if the Actuator endpoint is both enabled and exposed without security. CVE-2017-12611, at 4.15%, is the Struts Freemarker tag flaw from 2017.
Check the following drop paths:
~/.ssh/authorized_keys for keys nobody added intentionally
/dev/shm/.a, /var/tmp/.a, /tmp/.a
/etc/cron.d/.sys_monitor, /etc/cron.d/.s
If any of those turn up, isolate the host immediately and revoke everything it could see: AWS keys, cluster tokens, .env contents, registry credentials. Revoke, not rotate. Pull the persistence mechanisms first, or replacement credentials will follow the same path as the originals. Then audit where the compromised credentials were used while they were active.
XLab's published indicators include a C2 at 209.99.186[.]235, the domain cdnorigin[.]net, and one agent sample with SHA1 31c69b3e12936abca770d430066f379ec1d997ec.
For context: in April, The Hacker News covered a different operator targeting the same services. Censys found that campaign mining GPU resources for Monero and Conflux, plus running a Hysteria proxy for resale. NadMesh sweeps a considerably wider net, but exposed ComfyUI and Docker on port 2375 appear on both target lists.
The difference is the objective. The April operator wanted GPU time. NadMesh wants what the host can authenticate to. Censys closed its MCP census in late May speculating that exposed shell-capable MCP services would probably end up "part of some future botnet or abuse infrastructure." Seven weeks later, XLab published a botnet with mcp_cmd_execute in its exploit chart. The timeline was accurate. The word "future" was optimistic.