N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
Datadog researchers detonated a new N4D Mesh Controller sample in microVMs, revealing rotated infrastructure, a UPX-packed go-titan agent, and persistence behavior.
Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated command infrastructure and a UPX-packed agent labeled go-titan. Runtime evidence showed MCP tool abuse, multi-service scanning, and persistence mechanisms. The report provides hunting guidance for defenders tracking this infrastructure.
- New N4D Mesh Controller sample executed in isolated microVMs
- UPX-packed go-titan agent and rotated infrastructure discovered
- MCP tool abuse observed during runtime execution
- Multi-service scanning and persistence confirmed via runtime evidence
- Infrastructure hunting guidance provided for defenders
- Vendors
- Datadog
- Threat actors
- N4D Mesh Controller
- Malware
- N4D Mesh Controllergo-titan
- Organizations
- Datadog
From the original article
Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.
securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.