Rapid structural changes have been observed in the botnet landscape. XLab security researchers discovered NadMesh, a Go-based botnet that has been spreading rapidly since early July 2026.
This malware represents a clear evolution from opportunistic worm behavior to an industrial-grade, ROI-driven attack platform aimed squarely at artificial intelligence (AI) and model context protocol (MCP) infrastructure.
Unlike traditional worms that spread indiscriminately, NadMesh combines autonomous scanning, over 20 unique exploitation vectors, and Shodan-powered intelligence gathering into a single closed-loop system that operators refer to as an “n4d mesh controller.”
NadMesh uses Shodan to find and hijack exposed AI
NadMesh’s most distinctive feature is its dedicated reconnaissance module named: ai_harvest.py. This script programmatically queries the Shodan API for profiling of published AI and automation services, specifically applications such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio.
Once the exposed service is mapped, the malware automatically inserts the detected IP address into the highest priority tier scanning queue.
This technique reflects a broader threat trend already observed across the cloud ecosystem, with automated scanners combing cloud IP ranges for unauthenticated instances vulnerable to remote code execution.
By outsourcing initial reconnaissance tasks to Shodan, rather than relying solely on slow and resource-intensive brute force internet scans, NadMesh operators can immediately focus on live AI deployments rather than wasting bandwidth on dead address spaces.
Cybercriminals are continually optimizing these infrastructure scanning workflows. This is reminiscent of multi-stage operations like the EncryptHub campaign, which systematically targets internal corporate networks.
Comprehensive intelligence detailing conversion funnels, binary compilation patterns, and active infection clusters can be found in the comprehensive NadMesh Botnet Analysis report.
Botnet operations occur through five tightly coordinated stages: intelligence gathering, central control, autonomous task provisioning, polymorphic binary construction, and active distribution. A central controller listens on ports 80 and 8443 and leverages HMAC-authenticated beacons to manage a fleet of compromised bots.
It also exposes an advanced web admin panel with conversion funnel analysis, automated canary updates, and real-time operational visibility. These features are much more common in enterprise commercial software than traditional malicious code.
Once an endpoint is infected, the bot agent establishes a redundant persistence layer using an SSH authentication key backdoor, multiple hidden binary duplicates, and a cron-based watchdog process to ensure that removing a single artifact will not remove the infection.
The malware actively scans 30 different ports covering enterprise web services, Kubernetes clusters, database management systems, container APIs, and internal monitoring tools. AI service ports undergo strict prioritization during these sweeps, including, among other things:
- Port 8188: Comfortable UI
- Port 11434: Orama
- Port 5678: n8n
- Port 7860: gladio
Its exploit vectors span over 20 vectors and target legacy flaws such as MCP JSON-RPC tool invocation, malicious Kubernetes pod creation, Docker API container escaping, unauthenticated Redis instances, Elasticsearch remote code execution (RCE), Jenkins Script Console component, and WebLogic deserialization.
| Target attack area | Main exploit vectors | Severity risk impact |
| MCP server | JSON-RPC tools/call -> execute_command run loop |
expensive |
| Kubernetes | Creating and combining malicious pods hostPath mount override |
expensive |
| docker API | Creating privileged containers to facilitate escape sequences | expensive |
| Redis infrastructure | Uncertified CONFIG SET file write operation |
expensive |
| AI service | Prioritizing ComfyUI, Ollama, n8n, and Gradio with Shodan sources | expensive |
In addition to establishing a foothold for initial access, compromised hosts are thoroughly mined for high-value architectural data.
This malware aggressively extracts AWS access keys, Amazon Bedrock credentials, and Kubernetes. ServiceAccount A token with a comprehensive inventory of cluster management scopes, local Docker configurations, and locally hosted AI models (including Llama2, Mistral, and active GPT-4 API tokens). It also collects exploitable internal MCP tool access configurations, including: execute_sql and execute_shell.
All recovered data is returned to a central dashboard that tracks aggregated certificate counts, active MCP vulnerabilities, and escapeable Docker hosts. Threat intelligence can prove to be much more useful to operators than the compromised computing resources themselves.
To evade signature-based detection mechanisms, NadMesh applies garbled obfuscation and UPX compression to ensure that every dynamically deployed binary has a completely unique cryptographic hash.
Additionally, it has an automated honeypot evasion mechanism that blacklists IP addresses after 10 consecutive deployment attempts with no infection results.
Administrators running active machine learning pipelines should continually deploy modern cyberattack simulation tools to assess model exposure to these automated architectural pivots.
Indicators of Compromise (IOC)
- Command and Control (C2) IP Node:
209.99.186.235 - C2 Content Delivery Network Domain:
cdnorigin.net
Strengthen your SOC by accelerating threat detection and rapid investigation. -> Integrate ANY.RUN with SOC now.
