NadMesh Botnet Emerges as a Sophisticated Threat to AI and MCP Infrastructure Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been rapidly spreading since early July 2026, marking a shift in cybercriminal tactics toward industrial-grade, ROI-driven attacks targeting Artificial Intelligence (AI) and Model Context Protocol (MCP) infrastructure. Unlike traditional worms, NadMesh operates as a closed-loop system dubbed the "n4d mesh controller" integrating autonomous scanning, over 20 unique exploitation vectors, and Shodan-powered intelligence harvesting. Its most distinctive feature is ai_harvest.py, a reconnaissance module that programmatically queries Shodan to identify exposed AI and automation services, including ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. Discovered IP addresses are prioritized for immediate exploitation, allowing the botnet to bypass inefficient brute-force scanning. The botnet follows a five-stage operation: 1. Intelligence gathering (Shodan-driven targeting) 2. Centralized control (HMAC-authenticated beacons on ports 80 and 8443) 3. Autonomous task supply (dynamic payload delivery) 4. Polymorphic binary construction (Garble obfuscation + UPX compression) 5. Active delivery (persistence via SSH backdoors, cron watchdogs, and hidden binaries) NadMesh prioritizes AI service ports, including: - 8188 (ComfyUI) - 11434 (Ollama) - 5678 (n8n) - 7860 (Gradio) Its exploitation arsenal includes: - MCP JSON-RPC tool calls (command execution loops) - Kubernetes malicious pod creation (hostPath mount overrides) - Docker API container escapes (privileged container creation) - Unauthenticated Redis instances (CONFIG SET file writes) - Elasticsearch RCE, Jenkins Script Console, and WebLogic deserialization flaws Beyond initial access, NadMesh exfiltrates high-value data, including: - AWS access keys & Amazon Bedrock credentials - Kubernetes ServiceAccount tokens (cluster-admin scopes) - Docker configurations & locally hosted AI models (Llama2, Mistral, GPT-4 API tokens) - Internal MCP tool configurations (execute_sql, execute_shell) To evade detection, the malware employs automated honeypot avoidance, blacklisting IPs that fail infection attempts after 10 consecutive deployments. Its web-based management panel complete with conversion-funnel analytics and real-time operational visibility resembles enterprise-grade software, underscoring its sophistication. Indicators of Compromise (IOCs): - C2 IP Node: `209.99.186.235` - C2 CDN Domain: `cdnorigin.net`