NadMesh Botnet Emerges as a Sophisticated Threat to AI and MCP Infrastructure
Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been rapidly spreading since early July 2026, marking a shift in cybercriminal tactics toward industrial-grade, ROI-driven attacks targeting Artificial Intelligence (AI) and Model Context Protocol (MCP) infrastructure.
Unlike traditional worms, NadMesh operates as a closed-loop system dubbed the "n4d mesh controller" integrating autonomous scanning, over 20 unique exploitation vectors, and Shodan-powered intelligence harvesting. Its most distinctive feature is ai_harvest.py, a reconnaissance module that programmatically queries Shodan to identify exposed AI and automation services, including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. Discovered IP addresses are prioritized for immediate exploitation, allowing the botnet to bypass inefficient brute-force scanning.
The botnet follows a five-stage operation:
- Intelligence gathering (Shodan-driven targeting)
- Centralized control (HMAC-authenticated beacons on ports 80 and 8443)
- Autonomous task supply (dynamic payload delivery)
- Polymorphic binary construction (Garble obfuscation + UPX compression)
- Active delivery (persistence via SSH backdoors, cron watchdogs, and hidden binaries)
NadMesh prioritizes AI service ports, including:
- 8188 (ComfyUI)
- 11434 (Ollama)
- 5678 (n8n)
- 7860 (Gradio)
Its exploitation arsenal includes:
- MCP JSON-RPC tool calls (command execution loops)
- Kubernetes malicious pod creation (hostPath mount overrides)
- Docker API container escapes (privileged container creation)
- Unauthenticated Redis instances (CONFIG SET file writes)
- Elasticsearch RCE, Jenkins Script Console, and WebLogic deserialization flaws
Beyond initial access, NadMesh exfiltrates high-value data, including:
- AWS access keys & Amazon Bedrock credentials
- Kubernetes ServiceAccount tokens (cluster-admin scopes)
- Docker configurations & locally hosted AI models (Llama2, Mistral, GPT-4 API tokens)
- Internal MCP tool configurations (execute_sql, execute_shell)
To evade detection, the malware employs automated honeypot avoidance, blacklisting IPs that fail infection attempts after 10 consecutive deployments. Its web-based management panel complete with conversion-funnel analytics and real-time operational visibility resembles enterprise-grade software, underscoring its sophistication.
Indicators of Compromise (IOCs):
- C2 IP Node:
209.99.186.235 - C2 CDN Domain:
cdnorigin.netSource: https://cybersecuritynews.com/nadmesh-uses-shodan/
ComfyUI TPRM report: https://www.rankiteo.com/company/comfyui
Langflow TPRM report: https://www.rankiteo.com/company/langflow
Ollama TPRM report: https://www.rankiteo.com/company/ollama
Gradio TPRM report: https://www.rankiteo.com/company/gradio
Open WebUI TPRM report: https://www.rankiteo.com/company/openai
"id": "gracomollopelan1784435194",
"linkid": "gradio, comfyui, ollama, openai, langflow",
"type": "Cyber Attack",
"date": "7/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': ['Technology',
'Artificial Intelligence',
'Cloud Computing'],
'type': ['AI service providers',
'MCP infrastructure operators',
'Kubernetes clusters',
'Docker environments']}],
'attack_vector': ['Exploitation of vulnerable services',
'Shodan-powered intelligence harvesting',
'MCP JSON-RPC tool calls',
'Kubernetes malicious pod creation',
'Docker API container escapes',
'Unauthenticated Redis instances',
'Elasticsearch RCE',
'Jenkins Script Console',
'WebLogic deserialization flaws'],
'data_breach': {'data_exfiltration': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Credentials',
'Configuration files',
'AI model tokens',
'ServiceAccount tokens']},
'date_detected': '2026-07-01',
'description': 'Security researchers at XLab have uncovered NadMesh, a '
'Go-based botnet that has been rapidly spreading since early '
'July 2026, targeting Artificial Intelligence (AI) and Model '
'Context Protocol (MCP) infrastructure. NadMesh operates as a '
'closed-loop system with autonomous scanning, over 20 unique '
'exploitation vectors, and Shodan-powered intelligence '
'harvesting. It prioritizes AI service ports and exfiltrates '
'high-value data, including AWS access keys, Kubernetes '
'tokens, and AI model configurations.',
'impact': {'data_compromised': ['AWS access keys',
'Amazon Bedrock credentials',
'Kubernetes ServiceAccount tokens '
'(cluster-admin scopes)',
'Docker configurations',
'Locally hosted AI models (Llama2, Mistral, '
'GPT-4 API tokens)',
'Internal MCP tool configurations '
'(execute_sql, execute_shell)'],
'operational_impact': 'Potential disruption of AI and automation '
'services due to exploitation and data '
'exfiltration',
'systems_affected': ['AI and MCP infrastructure',
'Kubernetes clusters',
'Docker containers',
'Redis instances',
'Elasticsearch',
'Jenkins',
'WebLogic']},
'initial_access_broker': {'backdoors_established': ['SSH backdoors',
'Cron watchdogs',
'Hidden binaries'],
'entry_point': ['Exposed AI services',
'Vulnerable Kubernetes/Docker/Redis '
'instances'],
'high_value_targets': ['AI infrastructure',
'MCP services',
'Kubernetes clusters']},
'investigation_status': 'Ongoing',
'motivation': ['Data exfiltration',
'Financial gain',
'Industrial-grade ROI-driven attacks'],
'post_incident_analysis': {'root_causes': ['Exposed AI and MCP services',
'Misconfigured '
'Kubernetes/Docker/Redis instances',
'Lack of authentication for '
'critical services']},
'ransomware': {'data_exfiltration': True},
'references': [{'source': 'XLab Security Research'}],
'title': 'NadMesh Botnet Emerges as a Sophisticated Threat to AI and MCP '
'Infrastructure',
'type': 'Botnet',
'vulnerability_exploited': ['Exposed AI and automation services (ComfyUI, '
'Ollama, n8n, Open WebUI, Langflow, Gradio)',
'Unauthenticated Redis instances',
'Elasticsearch RCE',
'Jenkins Script Console',
'WebLogic deserialization flaws',
'Kubernetes misconfigurations',
'Docker API misconfigurations']}