Loading malware…
NadMesh is a Go-based botnet and autonomous attack platform focused on exposed cloud, container, and AI infrastructure, particularly services associated with the Model Context Protocol ecosystem and self-hosted AI tooling. Observed since early July 2026, it combines internet-scale scanning, automated exploitation, persistence, credential theft, and AI-service intelligence collection within a centralized operational framework.
The malware uses a controller-driven architecture to coordinate scanning across large IP ranges, including cloud-provider address space, while also prioritizing targets identified through Shodan-based reconnaissance. Reported target technologies include exposed Docker and Kubernetes APIs, Redis, Elasticsearch, Jenkins, WebLogic, and MCP implementations capable of command execution, as well as AI-related platforms such as Ollama, ComfyUI, Open WebUI, Langflow, Gradio, and n8n. NadMesh supports more than 20 exploitation vectors and can continue scanning or rescanning productive targets autonomously, with logic intended to reduce repeated interaction with suspected honeypots.
After compromise, NadMesh establishes persistence through SSH authorized-key backdoors, hidden binary copies, and cron-based watchdog mechanisms. It uses polymorphic build techniques, including obfuscation, packing, and randomized padding, to hinder signature-based detection and ensure deployed samples differ across infections. The botnet’s controller manages bot registration, tasking, result collection, and operator visibility through a web panel.
NadMesh places particular emphasis on harvesting high-value access material rather than merely retaining host control. Reported collection objectives include cloud credentials, environment-variable secrets, Kubernetes service account tokens, Docker configuration data, SSH session material, AI model inventories, and information about exposed or exploitable MCP services. This indicates an operational objective centered on downstream access to cloud resources, cluster privileges, and AI-related assets. The threat actor behind NadMesh is not publicly identified with high confidence.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
This script programmatically queries the Shodan API for exposed AI and automation services, specifically profiling applications such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio.
First, a Python script actively harvests intelligence by searching for exposed AI assets online.
Attackers utilize the Shodan search engine API to uncover these vulnerable assets. Once identified, the system immediately injects these specific addresses into its high-priority scan queues.
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords.
The malware targets exposed services such as Docker APIs, Kubernetes APIs, Redis, Elasticsearch, Jenkins, WebLogic, and MCP implementations capable of command execution.
NadMesh uses a centralized controller to coordinate scanning across large IP ranges and attempts exploitation using more than 20 supported attack vectors. The malware targets exposed services such as Docker APIs, Kubernetes APIs, Redis, Elasticsearch, Jenkins, WebLogic, and MCP implementations capable of command execution.
Then check the drop paths: ~/.ssh/authorized_keys... /etc/cron.d/.sys_monitor, /etc/cron.d/.s
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
MCP JSON-RPC tools/call → execute_command 高
Then check the drop paths: ~/.ssh/authorized_keys... /etc/cron.d/.sys_monitor, /etc/cron.d/.s
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords.
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
The malware targets exposed services such as Docker APIs, Kubernetes APIs, Redis, Elasticsearch, Jenkins, WebLogic, and MCP implementations capable of command execution.
Then check the drop paths: ~/.ssh/authorized_keys... /etc/cron.d/.sys_monitor, /etc/cron.d/.s
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords.
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
The system uses code obfuscation and random padding to change the malware hash dynamically. Consequently, this polymorphic approach defeats traditional signature-based detection tools.
To evade signature-based detection mechanisms, NadMesh applies Garble obfuscation and UPX compression
/cdn/<binaryToken>/assets/img.bin 开放 伪装成静态资源的二进制分发
signature stripping ... hidden cron watchdogs ... persistence files in multiple locations (/dev/shm/.a, /var/tmp/.a, /tmp/.a)
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords.
Once an endpoint is infected, bot agents establish redundant persistence layers using SSH authorized-key backdoors, multiple hidden binary duplicates, and cron-based watchdog processes.
Following successful exploitation, the malware establishes persistence through SSH authorized keys, hidden binaries, and scheduled cron jobs.
SSH/Telnet 弱口令爆破 中 部署后门
It collects cloud credentials, Kubernetes service account tokens, Docker configuration files, environment variables, and information about deployed AI models and MCP services before reporting the data to its command-and-control server.
It collects cloud credentials, Kubernetes service account tokens, Docker configuration files, environment variables... before reporting the data to its command-and-control server.
files: aws_config: ~/.aws/config, env_file: .env, docker_config: ~/.docker/config.json
"files": {"aws_config": "~/.aws/config", "env_file": ".env", "docker_config": "~/.docker/config.json"}
All recovered data is funneled back to a central dashboard that tracks aggregate certificate counts, active MCP vulnerabilities, and escapable Docker hosts
"internal_ranges": ["10.0.0.0/8", "172.16.0.0/12"]
The agent simultaneously performs ... internal network scanning ... internal_ranges: ["10.0.0.0/8", "172.16.0.0/12"]
NadMesh uses a centralized controller to coordinate scanning across large IP ranges... The campaign also prioritizes AI-related services—including Ollama, ComfyUI, Open WebUI, Langflow, Gradio, and n8n—which are identified through Shodan searches and added to the scanning queue.
"profile": {"hostname": "prod-server-01", "os": "linux", "arch": "x86_64", "kernel": "5.10.0"
It collects cloud credentials, Kubernetes service account tokens, Docker configuration files, environment variables, and information about deployed AI models and MCP services before reporting the data to its command-and-control server.
metadata.profile ... "services": ["redis", "docker", "k8s"], ... "docker_host": true, "in_container": false
覆盖的服务面: ... Kubernetes:6443(API)/10250(kubelet)/2379(etcd) ... 容器:2375/2376(Docker API)
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: an open Docker API on 2375, a Jenkins script console, unauthenticated Redis, weak Telnet, and SSH passwords.
maintaining P2P links to the controller and to peers on the same subnet via beacons — giving it lateral self-propagation
When a bot successfully breaches a system, it immediately begins harvesting valuable intelligence.
It collects cloud credentials, Kubernetes service account tokens, Docker configuration files, environment variables, and information about deployed AI models and MCP services before reporting the data to its command-and-control server.
controller_go.go ,监听 80/8443 端口,负责 Bot 注册与 beacon 回连... ▼ HTTP /api/*
/api/agent/binary(.gz) 开放 下发 agent 二进制(按 arch) ... /api/agent/loader 开放 下发 722KB 轻量 loader(后台再拉 full)
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.