NadMesh botnet targets exposed AI services, steals 3,811 AWS keys
This digest was compiled by AI from multiple sources — links to the originals are below.
A Go-based botnet called NadMesh emerged in early July, hunting exposed AI services and harvesting cloud credentials. The operator's dashboard claims 3,811 unique AWS keys, 47 credential hauls, and 41 model inventories, according to QiAnXin's XLab report published Friday.
Botnet Operations
NadMesh uses a Shodan harvester to scan for exposed services including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The botnet collects cloud keys from environment variables, Kubernetes service account tokens, and files like ~/.aws/config and ~/.docker/config.json. XLab observed distinct source IPs pushing NadMesh rising from near zero in late June to around 139 per day in early July.
Exploitation Vectors
The botnet prioritizes MCP (Model Context Protocol) exploitation, followed by Kubernetes, Docker API, and Redis. XLab recorded docker_containers_api_rce accounting for 30.31% of observed exploit traffic, jenkins_scripttext_rce at 22.28%, and Telnet weak passwords at 10.36%. The mcp_cmd_execute vector was observed but at only 0.78% of traffic.
MCP Security Concerns
MCP's initial specification left authentication outside the core protocol, and the authorization flow added in March 2025 remains optional. Censys counted 12,520 reachable MCP services across 8,758 IP addresses as of April 28, growing to over 21,000 by May 6. Of these, 39 advertised a tool named execute_command, the exact call at the top of NadMesh's exploitation priority list.
What's Next
XLab's report is likely to prompt security advisories for organizations running exposed AI services. It remains unclear whether MCP developers will mandate authentication in future protocol updates.
1 source
NadMesh botnet targets exposed AI services, steals 3,811 AWS keys
