NadMesh Botnet Targets Exposed AI and MCP Services for Cloud Credential Theft

Researchers reported that the NadMesh botnet is actively targeting exposed AI platforms and administrative services to steal cloud credentials, Kubernetes tokens, model access, and callable Model Context Protocol (MCP) tools. The Go-based malware, first observed in early July, scans for services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio, while also exploiting exposed Docker APIs, Jenkins script consoles, Redis, Telnet, Kubernetes, Elasticsearch, Airflow, Superset, WebLogic, and other weakly secured systems. QiAnXin XLab said the operation uses a productized architecture with a controller, web panel, adaptive tasking, polymorphic builds, and persistence via SSH authorized_keys, hidden binaries, and cron watchdogs; published indicators include C2 IP 209.99.186[.]235, domain cdnorigin[.]net, and sample SHA1 31c69b3e12936abca770d430066f379ec1d997ec.

The campaign is exploiting a broader security gap around Internet-exposed MCP deployments, which Censys said numbered 12,520 accessible services across 8,758 IPs in 56 countries, with most running protocol version 2025-03-26. The MCP specification does not require authentication or authorization by default, and Censys found many exposed servers advertising sensitive capabilities such as database access, system control, enterprise integrations, and command-execution-style tools. Researchers cautioned that even authenticated MCP deployments remain at risk from abuse through trusted AI integrations, making exposed MCP infrastructure an attractive target for operators like NadMesh seeking data disclosure, unauthorized access, and downstream cloud compromise.