NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era

Summary

NadMesh is a Go-based botnet observed in early July 2026 that combines autonomous scanning, 20+ exploitation vectors, and targeted harvesting of AI-service and cloud credentials into a single productized platform. QiAnXin's XLab named it after the 'n4d mesh controller' string in its source and published its analysis, which The Hacker News summarized.^[0][8]

The operator's objective is not the host itself but the cloud credentials and Kubernetes cluster privileges reachable from it: bots exfiltrate cloud keys from environment variables, k8s service account tokens, and the contents of ~/.aws/config, .env, and ~/.docker/config.json, plus model access and callable MCP tools. The dashboard captured July 10 claims 3,811 unique AWS keys.^[0][8]

A Shodan-fed harvester keeps the queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio targets at highest priority, but most observed exploit traffic still lands on exposed Docker APIs and Jenkins consoles. XLab's sensors recorded distinct source IPs rising from near zero in late June to roughly 139 a day in the first week of July.^[0][8]

Attack chain

1. Intel harvesting: ai_harvest.py uses the Shodan API to find ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio assets and injects them into the scan queue at highest priority (priority=20), the most direct evidence of deliberate AI-infrastructure targeting.^[0][8]
2. Control: controller_go.go listens on ports 80 and 8443, handling bot registration and beacon callbacks, dispatching CIDR + port scan tasks, collecting deployment results and credential intelligence, and exposing the /panel dashboard.^[8]
3. Supply / self-feeding scan loop: Four scripts amplify the scan queue: high-yield subnets are resampled more densely every five minutes, dangerous IPs are rescanned as /32s every quarter hour with AI ports first, full sweeps re-prioritize seven-day dangerous hosts, and targets absorbing ten deployment attempts without result are auto-blacklisted as suspected honeypots. If the queue runs dry, bots generate a random /24.^[0][8]
4. Build: build_agent.sh applies Garble obfuscation, UPX -9 packing, and random padding so every agent carries a distinct hash, defeating signature-based detection.^[0][8]
5. Delivery / exploitation: Delivery is handled via Docker/MCP/Redis vectors and a binary+watchdog push; observed exploit traffic is dominated by docker_containers_api_rce and jenkins_scripttext_rce, with Telnet, Redis, and patch-based vectors including CVE-2026-39987 (Marimo) and CVE-2026-41176 (rclone).^[0][8]
6. Persistence and credential theft: On the victim the agent establishes three independent persistence paths (SSH authorized_keys backdoor, hidden binaries in /dev/shm, /var/tmp, /tmp, and cron watchdogs) and exfiltrates cloud keys, Kubernetes tokens, .env contents, and registry logins.^[0][8]

Disclosure timeline

How it works

NadMesh spreads mainly by abusing exposed services and callable admin functionality rather than a single novel flaw: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords, none of which are closed by a patch. MCP tops the priority order via a JSON-RPC tools/call to execute_command, exploiting MCP deployments that skip the optional authorization flow.^[0]

The patch-based vectors include CVE-2026-39987, a pre-auth RCE in Marimo notebooks before 0.23.0, and CVE-2026-41176, which lets an unauthenticated caller flip rc.NoAuth on rclone RC servers (1.45.0 to 1.73.5) started without HTTP auth; older entries include CVE-2022-22947 (Spring Cloud Gateway Actuator, only when enabled and exposed unsecured) and CVE-2017-12611 (Struts Freemarker tag flaw).^{[0][29][30][31][32]}

Affected versions and patch status

Indicators of Compromise

Key takeaways

• NadMesh is a productized, continuously iterated botnet whose payoff is cloud credentials, Kubernetes privileges, and AI-service access rather than the host, reflecting a shift from GPU cryptomining toward what a compromised box can log into.^[0][8]
• Signature-based detection is largely defeated: Garble obfuscation, UPX packing, and random padding give every agent a unique hash, so the single published sample hash catches only one build.^[0][8]
• AI targeting is real at the intake and in the loot, but most exploit traffic still lands on exposed Docker APIs and Jenkins consoles, so the fastest wins are getting exposed services behind authentication.^[0]

Defensive actions

• Place exposed services behind authentication or off the public internet, starting with ports 8188 (ComfyUI), 11434 (Ollama), 7860 (Gradio), and 5678 (n8n).: These are the four ports NadMesh's rescan job prioritizes; no patch closes exposed-service and admin-function abuse.^[0]
• Lock down Docker API on 2375, Jenkins script consoles, unauthenticated Redis, weak Telnet, and SSH passwords, and enable authorization on MCP servers.: Most observed exploit traffic targets Docker sockets and Jenkins consoles, and MCP execute_command tools tops the exploitation priority order; none of these are closed by a patch.^[0]
• Patch or restrict CVE-2026-39987 (Marimo before 0.23.0) and CVE-2026-41176 (rclone 1.45.0-1.73.5 without HTTP auth), and verify conditions for CVE-2022-22947 and CVE-2017-12611.: These are active vectors in NadMesh's exploit chart; the Marimo flaw was exploited within hours of disclosure and is on CISA KEV.^{[0][29][30][31][32]}
• Hunt for NadMesh drop paths and, if found, isolate the host and revoke every credential it could see before issuing replacements.: Persistence is built to survive single-point removal; revoking (not rotating) and pulling persistence first prevents new keys being harvested like the old ones.^[0][8]