Malwarehigh
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-12611 | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a… | 9.8 | 87% | PoC | |
| CVE-2022-22947 | Unauthenticated RCE in VMware Spring Cloud Gateway | 10.0 | 98% | KEVPoC ×2 | KEV |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook | 9.3 | 100% | KEVPoC ×8 | KEV |
| CVE-2026-41176 | Unauthenticated Access Control Bypass in Rclone RC options/set Endpoint | 9.2 | 33% | PoC |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdnorigin.net | XLab's indicators are a C2 at 209.99.186[.]235, the domain cdnorigin[.]net, and one agent sample, SHA1 31c69b3e12936abca770d430066f3 |
| ipv4 | 209.99.186.235 | re used while they were live. XLab's indicators are a C2 at 209.99.186[.]235, the domain cdnorigin[.]net, and one agent sample, SHA1 3 |
| sha1 | 31c69b3e12936abca770d430066f379ec1d997ec | 235, the domain cdnorigin[.]net, and one agent sample, SHA1 31c69b3e12936abca770d430066f379ec1d997ec. The Hacker News covered a different operator working the s |
From the original article
5 min read at thehackernews.com
A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama , n8n , Open WebUI , Langflow , and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast and firewall late.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.