NadMesh Botnet Targets Exposed AI Services to Steal Cloud Credentials and Kubernetes Tokens

Key Findings

• Go-based botnet NadMesh emerged in early July targeting exposed AI services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio

• Operator dashboard shows 3,811 unique AWS keys harvested with credential theft as primary objective

• Botnet extracts cloud credentials, Kubernetes service account tokens, Docker configs, and environment variables from compromised hosts

• Docker API exploitation dominates observed traffic at 30.31%, followed by Jenkins script execution at 22.28%

• MCP protocol exploitation prioritized in targeting hierarchy despite low observed success rates

• Five concurrent build versions running with Garble obfuscation and UPX packing to evade hash-based detection

• Persistent triple-layer installation mechanism designed to survive removal attempts

• Censys identified over 21,000 reachable MCP services by May 6 with roughly 90 advertising command execution tools

Background

NadMesh takes its name from the "n4d mesh controller" string found in its source code. QiAnXin's XLab published the initial analysis on Friday, capturing screenshots of the operator's control panel dated July 10. The botnet is written in Go and uses a Shodan-based harvester to continuously scan the internet for vulnerable AI infrastructure and exposed services. Active deployment attempts jumped from near zero in late June to around 139 unique source IPs per day in the first week of July.

The Operator's Claims Versus Reality

The control panel reveals inconsistencies in the operator's own metrics. A counter claims 17,700 total deployments while a separate funnel reports 95,700 in the past 24 hours. Bot counts fluctuate between 16 and 12 active agents on different dashboard tiles. The credential harvest number at 3,811 AWS keys appears consistently, suggesting this metric at least receives regular updates. XLab's external sensors provide independent validation: they detected source IPs pushing NadMesh reaching approximately 139 unique addresses daily during the first week of July, providing an outside measure that contradicts the dashboard's inflated deployment claims.

What Gets Stolen

The botnet systematically harvests cloud credentials, Kubernetes cluster privileges, model access tokens, and callable MCP tools. Specific targets include AWS credentials from environment variables and ~/.aws/config files, Docker authentication from ~/.docker/config.json, and service account tokens from Kubernetes deployments. The researcher assessment is direct: the operator targets "not the host itself, but the cloud credentials, Kubernetes cluster privileges" and the callable services running on those hosts.

The MCP Priority

Model Context Protocol tools rank highest in NadMesh's exploitation hierarchy, above Kubernetes, Docker APIs, and Redis services. The specific vector employed is a JSON-RPC tools/call to execute_command. However, the operator's claimed success metrics do not align with observed reality. The dashboard lists 12,100 MCP services as exploitable with 21 reported vulnerabilities, yet the last 100 intelligence records show zero MCP exploitation successes. Censys telemetry showed 12,520 reachable MCP services across 8,758 IP addresses in late April, growing to over 21,000 by early May, with approximately 90 advertising command execution capabilities. The MCP specification made authentication optional in March 2025, and many deployments remain unprotected.

Observed Exploitation Traffic

XLab charted actual exploit attempts detected in network traffic, revealing a different priority order than the dashboard suggests. Docker container API remote code execution comprises 30.31% of traffic, Jenkins script text execution takes 22.28%, weak Telnet passwords account for 10.36%, and Redis exploitation represents 8.29%. MCP command execution appears in the unlabeled tail below 1%, at just 0.78% of observed traffic. This suggests the operator's dashboard success metrics exclude the AI and cloud credential harvesting that appears central to the campaign's objective, with the scoreboard footnote explicitly excluding Ollama and AWS harvest results from their own success calculations.

Scanning and Resampling Strategy

The botnet feeds its own scanning pipeline through dynamic resampling. Subnets producing successful hits get rescanned more densely every five minutes. IPs flagged as dangerous in the last 24 hours receive every quarter hour rescan as /32 targets with AI service ports prioritized. A full sweep recycles all targets marked dangerous within the last seven days to the top of the queue. Any target absorbing ten deployment attempts without returning results gets auto-blacklisted as a suspected honeypot, indicating the author monitors for researcher observation. When the queue depletes, bots generate random /24 subnets and continue scanning.

Evasion and Persistence

The botnet runs five concurrent build versions, with eleven bots operating on version 33.8-GO-TITAN and stragglers remaining on version 30.0. A canary endpoint stages new builds to a portion of the fleet before full deployment. Every agent undergoes Garble obfuscation, UPX -9 packing, and random padding, ensuring no two agents share identical hashes. This means a single published sample hash will only catch that specific build while missing all others in the wild. Persistence relies on three simultaneous installation mechanisms, so removing one allows the others to restore functionality. This redundant approach makes single-vector removal ineffective.

Defensive Measures

Most NadMesh exploitation targets exposed services and admin functionality left callable without authentication: open Docker APIs on port 2375, Jenkins script consoles, unauthenticated Redis, weak Telnet and SSH credentials. No patch closes these vector categories because they represent configuration choices rather than software bugs. The immediate mitigation requires placing these services behind authentication or removing them from public internet access. The four ports that NadMesh's rescan job prioritizes should receive immediate attention: port 8188 for ComfyUI, 11434 for Ollama, 7860 for Gradio, and additional AI service ports. Organizations running these tools should verify they are not externally accessible and that any cloud credential files remain protected from process inspection by other running services.

Sources

• https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html

• https://x.com/TheCyberSecHub/status/2078168298626384109

• https://www.linkedin.com/posts/thehackernews_new-nadmesh-botnet-malware-hunts-exposed-activity-7483932511425802242-W-_A

• https://x.com/TheHackersNews/status/2078166645672124677

• https://www.reddit.com/r/SecOpsDaily/comments/1uz7d5e/new_nadmesh_botnet_hunts_exposed_ai_services_for