ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Datadog Security Labspublished ()ingested

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

mediumMalwareimportance 55
AI summary · glm-5.3-flash

Datadog researchers detonated a new N4D Mesh Controller sample in microVMs, revealing rotated infrastructure, a UPX-packed go-titan agent, and persistence behavior.

Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated command infrastructure and a UPX-packed agent labeled go-titan. Runtime evidence showed MCP tool abuse, multi-service scanning, and persistence mechanisms. The report provides hunting guidance for defenders tracking this infrastructure.

  • New N4D Mesh Controller sample executed in isolated microVMs
  • UPX-packed go-titan agent and rotated infrastructure discovered
  • MCP tool abuse observed during runtime execution
  • Multi-service scanning and persistence confirmed via runtime evidence
  • Infrastructure hunting guidance provided for defenders
Read the original
VendorsDatadog
Threat actorsN4D Mesh Controller
MalwareN4D Mesh Controllergo-titan
OrganizationsDatadog
Tagsdatadogn4d-mesh-controllergo-titanupxmcpinfrastructure-huntingmalware-analysis
Full article

Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.

This source does not provide full text. Read it at securitylabs.datadoghq.com.