New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

# NadMesh Botnet Weaponizes Exposed AI Services to Harvest Cloud Credentials and Kubernetes Tokens

A rapidly spreading Go-based botnet is systematically targeting exposed AI infrastructure—including popular frameworks like Ollama, ComfyUI, and Langflow—to extract AWS keys, Kubernetes service account tokens, and access to MCP (Model Context Protocol) services. Security researchers at QiAnXin's XLab disclosed the campaign, tracked as NadMesh, on Friday, revealing an operation that has already harvested thousands of credentials and maintains hundreds of active infection vectors.

The operator's own dashboard, captured July 10, advertises 3,811 unique AWS keys extracted from compromised systems. The botnet's aggressive scanning infrastructure continuously hunts for misconfigured AI services, prioritizing cloud credential theft above all other objectives.

## The Threat: Credential Harvesting at Scale

NadMesh operates as a credential-focused botnet, not a traditional host-takeover malware. Its singular mission is to extract cloud secrets and infrastructure access tokens from development and deployment environments where AI services run.

What the botnet targets:

The intelligence feed behind NadMesh's dashboard shows 47 credential hauls and 41 model inventories in its last 100 records. This is not random probing—the operator is systematically profiling what cloud access and computational resources each target holds.

## Background: Why AI Services Are Exposed

Teams deploying AI infrastructure—developers spinning up Ollama for local model inference, operations running Gradio web interfaces, workflow platforms like n8n and Langflow operating in shared environments—frequently prioritize speed over perimeter security. These services are often stood up in development environments, temporary deployments, or behind corporate networks assumed to be protected. Many lack authentication entirely.

The targeted frameworks represent common, legitimate use cases:

A Shodan harvester continuously feeds NadMesh's scanning queue with IP addresses hosting these services. Public internet exposure is the prerequisite; weak or missing authentication is the vulnerability.

## Technical Details: Exploits and MCP Vulnerability

QiAnXin's report identifies NadMesh's exploit chain, with priority order revealing the operator's true target hierarchy:

| Exploit Vector | Observed Traffic | Impact |

|---|---|---|

| Docker Container API RCE | 30.31% | Full host compromise via socket access |

| Jenkins ScriptText RCE | 22.28% | Cluster access if Jenkins has credentials |

| Telnet Weak Passwords | 10.36% | Direct shell access on unsecured systems |

| Redis Exploitation | 8.29% | Credential/data extraction from caches |

| MCP Command Execution | ~0.78% | Tool invocation, but exploited last |

The chart reveals an apparent contradiction: MCP command execution ranks highest in the controller's priority table but appears as a negligible percentage of actual exploit traffic. This suggests either the operator is still optimizing, or the MCP infrastructure is better protected than Docker and Jenkins endpoints.

### The MCP Protocol Problem

The Model Context Protocol—an emerging standard for AI applications to invoke external tools—has a critical security posture issue: authentication is optional. MCP's first specification left authentication entirely outside the core protocol. A March 2025 authorization flow was added, but remains optional per the spec's own language. This means many deployments operate without any authentication layer.

Censys data provides sobering scope: 12,520 reachable MCP services across 8,758 unique IP addresses as of April 28. That number jumped to 21,000+ by May 6—explosive growth in deployed, internet-facing MCP instances. Of particular concern, roughly 90 MCP services advertised command execution tools, with at least 39 services hosting tools explicitly named execute_command—the exact call NadMesh targets.

## Scanning Tactics: Adaptive and Intelligent

NadMesh deploys a feedback-driven scanning engine designed to maximize hit rate and evade detection:

Five build versions run concurrently, with eleven bots deployed across 33 distinct infrastructure points. XLab's sensor data shows distinct source IPs pushing NadMesh sat near zero through late June, then spiked dramatically in the first week of July, reaching around 139 unique source IPs per day.

## Dashboard Inconsistencies and Operator Visibility

The NadMesh dashboard itself contains notable discrepancies that complicate threat assessment:

These discrepancies hint at either an immature operation still stabilizing infrastructure, or an operator deliberately introducing noise to mislead analysis.

## Who Is Exposed

Any organization running AI development frameworks—especially ComfyUI, Ollama, n8n, Langflow, Gradio, or Open WebUI—on systems with:

This includes startups rapidly prototyping AI applications, enterprises experimenting with LLM integrations, research institutions running shared model infrastructure, and managed service providers offering AI tools to multiple customers.

## Recommendations for Defenders

Immediate actions:

1. Audit exposure: Use Shodan/Censys to search for your organization's ComfyUI, Ollama, n8n, and Gradio instances. Any public-facing deployment should be considered a risk.

2. Credential rotation: If you operate any of these services on the internet, assume credentials may have been harvested. Rotate all AWS keys, Kubernetes service accounts, and Docker credentials immediately.

3. MCP authentication: If deploying MCP services, enforce authentication. The optional authorization flow in MCP's specification must be treated as mandatory in practice.

4. Firewall AI services: ComfyUI, Ollama, Langflow, and similar tools should not be internet-facing. Restrict access via VPN, private networks, or identity-aware proxies.

5. Environment variable hardening: Do not store AWS credentials, Docker tokens, or Kubernetes configs in environment variables. Use temporary credential providers (AWS STS, IAM roles, managed identity services).

6. Log analysis: Search cloud account logs for credential usage from unexpected geographies or at unusual times. Examine CloudTrail, Docker Hub, Kubernetes audit logs for anomalous activity.

---

## HackWire Analysis

NadMesh highlights a collision between the speed of AI adoption and the maturity of its security ecosystem. Organizations are deploying LLM interfaces, local model runners, and AI workflow platforms at unprecedented pace—but these tools arrived without hardened-by-default configurations. Developers trained in moving fast, not in cloud security, are standing up infrastructure that exposes cryptographic credentials to the public internet.

The botnet's sophistication—adaptive scanning, honeypot detection, priority-ranked exploitation, intelligent queue management—suggests an operator who understands both the targets and the defenders watching them. The fact that MCP command execution sits far below Docker and Jenkins exploits doesn't mean it's unimportant. It may mean the operator is still calibrating the payoff-to-risk ratio, or that MCP deployments, being newer, haven't yet accumulated the critical density needed to justify heavy investment.

The real risk is the credential haul. AWS keys, Kubernetes tokens, and Docker credentials are not just access to the AI service itself—they're keys to cloud infrastructure, container orchestration, and potentially entire deployment pipelines. A single compromised ComfyUI instance can hand over access to an organization's AWS account, their Kubernetes cluster running production workloads, and their container registries. The NadMesh operator is not targeting the AI framework for its model weights. They're targeting it as an entry point to cloud infrastructure.

What's instructive is the pattern: Shodan continuously feeding scanning targets, intelligent prioritization based on observed success rates, automatic honeypot detection, and the operator's apparent awareness that researchers are monitoring them. This is not a mass-deployment botnet spraying everywhere indiscriminately. This is a targeted, learning-based operation that adapts to defensive pressure.

The MCP vulnerability deserves special attention. An emerging protocol designed to allow AI applications to call arbitrary tools—with authentication as an afterthought—is now being harvested en masse by a botnet. If MCP adoption accelerates without mandatory authentication enforcement, the next generation of this malware could graduate from credential theft to direct tool execution at scale. A compromised MCP service named execute_command is not just stealing cloud keys—it's running attacker-controlled code in the customer's infrastructure.

Organizations need to move MCP authentication from optional to mandatory, now. They need to stop treating AI service deployments as exempt from standard cloud security practices. And they need to assume that any AI framework exposed to the internet has already been compromised and credentials harvested. Rotate first, harden second.

— HackWire Editorial

---

## Related Coverage