Threat · curated 30 Jun 2026
Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints
First reported trendmicro.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
Internet-exposed AI app-building platforms like Langflow are being scanned and weaponized for RCE, making them an emerging target in the AI infrastructure supply chain.
Threat actors are actively exploiting CVE-2026-33017 (CVSS 9.3), an unauthenticated remote code execution flaw in Langflow, an AI application/agent workflow builder, to deploy a Monero cryptocurrency miner on exposed endpoints.
Summary
Trend Micro documented a cryptocurrency-mining campaign that weaponizes CVE-2026-33017 (CVSS 9.3), an unauthenticated remote code execution flaw in Langflow, to obtain initial access to exposed AI application endpoints. A single line of Python evaluated inside an unauthenticated Langflow API endpoint pulls down a shell script, fetches a miner binary, and launches it detached, ultimately deploying a bespoke Monero (XMRig) miner via a UPX-packed Go binary named 'lambsys.'[0][9][32]
The activity was observed over a 19-day window between March 27 and April 15, 2026. While the payload is a familiar commodity cryptominer tool chain, the novel element is the delivery vector — mass-scanning unauthenticated AI application infrastructure — giving commodity operators a new front door into enterprise networks running AI pipeline tools.[0][9]
Beyond mining, the malware terminates rival cryptominer processes (Kinsing, WatchDog, Rocke, Outlaw), disables host-level security controls, deletes rival wallet and key material, establishes cron-based persistence, beacons to an external C&C, and propagates to other systems via reused SSH keys — turning an exposed Langflow instance into a foothold for broader compromise.[0][9]
Attack chain
- Initial Access: Threat actors mass-scan the internet for exposed Langflow instances and exploit CVE-2026-33017, an unauthenticated RCE, by evaluating a single line of attacker-supplied Python inside an unauthenticated Langflow API endpoint.[0][9][32]
- Execution / Dropper: The Python payload launches a remotely hosted shell script acting as a dropper. The dropper checks whether a binary called 'lambsys' is already running, then downloads it via curl or wget and launches it as a detached process.[0]
- Defense Evasion: The UPX-packed Go ELF binary disables AppArmor, Ubuntu's Uncomplicated Firewall, iptables, SELinux, the kernel NMI watchdog, and Alibaba Cloud's Aliyun agent; removes system logs; and manipulates the immutable (chattr) attribute on SSH, crontab, and preload files before reapplying it to /tmp and /var/tmp.[0][9]
- Rival Removal: The malware terminates competing cryptominer processes associated with Kinsing, WatchDog, Rocke, and Outlaw, and deletes rival wallet and key material, reflecting awareness of persistence methods used by rival cryptojacking groups.[0]
- Persistence: The binary establishes cron-based persistence and reapplies immutable attributes to protect its footholds.[0][9]
- Command and Control: The binary beacons to an external server (83.142.209[.]214:80), fetches a TAR archive containing a bespoke XMRig miner, wipes the archive after extraction, and queries ipinfo[.]io to obtain the host's public IP and location for pool selection and geo-fencing decisions.[0]
- Lateral Movement: The dropper spreads itself to every SSH-reachable host the victim can authenticate to using reused SSH keys, enabling broader compromise beyond the initially exploited Langflow instance.[0][9]
Disclosure timeline
| Date | Event |
|---|---|
| May 2024 | An artifact belonging to a previous iteration of the same binary was compiled, indicating the threat actors have been iterating on the malware family for over two years.[0][9] |
| March 27 – April 15, 2026 | Trend Micro observed the 19-day window of Langflow exploitation via CVE-2026-33017 delivering the Monero miner.[0][9] |
| June 23, 2026 | Trend Micro researchers Simon Dulude and John Zhang published their technical report on the CVE-2026-33017 cryptominer campaign.[9] |
| June 30, 2026 | The Hacker News published its coverage of the Trend Micro findings.[0] |
How it works
CVE-2026-33017 is an unauthenticated remote code execution vulnerability in Langflow. Exploitation is achieved by evaluating a single line of attacker-supplied Python code inside an unauthenticated Langflow API endpoint, which pulls down a shell script that fetches and launches the miner binary detached.[0][9][32]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Langflow | Instances exposed to the public internet with the unauthenticated API endpoint vulnerable to CVE-2026-33017; risk is amplified where the application runs under a privileged account or with access to other systems. | Trend Micro advises applying relevant Langflow security updates and restricting public access.[9][32] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| cve | CVE-2026-33017 | Unauthenticated remote code execution vulnerability in Langflow (CVSS 9.3) used as the initial access vector for the cryptominer campaign.[0][9][32] |
| ip | 83.142.209.214 | External C&C server the lambsys binary beacons to on port 80 and from which it fetches the TAR archive containing the XMRig miner.[0] |
| domain | ipinfo.io | Queried by the binary to obtain the host's public IP address and location for mining pool selection and geo-fencing decisions.[0] |
| file-path | lambsys | Name of the UPX-packed Go ELF miner/dropper binary; the dropper checks whether it is already running before downloading and launching it detached.[0][9] |
| file-path | /etc/ld.so.preload | One of the files whose immutable attribute the malware removes to make modifications during persistence and evasion.[0] |
| cve | CVE-2025-3248 | A separate critical Langflow flaw (CVSS 9.8) abused in June 2025 to distribute the Flodrix botnet, showing repeated exploitation of Langflow.[0][34] |
Key takeaways
- Exposed, unauthenticated AI application endpoints such as Langflow are becoming a fresh initial-access vector for commodity cryptominer operators; the payload is familiar but the delivery vector is new.[0][9]
- Langflow has repeatedly been targeted (CVE-2025-3248 for Flodrix in 2025 and now CVE-2026-33017), so defenders should treat internet-exposed AI pipeline tooling as high-risk attack surface.[0][34]
Defensive actions
- Determine whether any Langflow instances are exposed to the public internet and restrict public access.: Exposed unauthenticated Langflow API endpoints are the front door for CVE-2026-33017 exploitation.[9]
- Apply relevant Langflow security updates.: Patching the RCE vulnerability closes the initial access vector being actively exploited.[9]
- Review whether the Langflow service runs with more privileges than required or on infrastructure with access to other systems.: Excessive privileges and SSH connectivity enable the malware's lateral movement via reused SSH keys and broader compromise.[0][9]
- Treat any signs of compromise as a potential incident and hunt for miner IoCs such as the C&C IP 83.142.209.214 and the lambsys binary.: The malware disables security controls, deletes logs, and establishes persistence, so compromise should be investigated fully.[0][9]