NadMesh botnet scans for exposed AI services to steal cloud and cluster keys

Researchers at XLab detailed NadMesh, a Go based botnet spreading since early July that hunts exposed AI and automation services rather than raw computing power. A reconnaissance module queries a public device search engine for internet facing instances of tools like Ollama, ComfyUI, n8n, Open WebUI, Langflow, and Gradio, then works through more than twenty exploitation paths. What it ships home is credentials: cloud access keys pulled from environment variables, Kubernetes service account tokens, and the contents of files like .env and Docker configuration. Callable tool endpoints on AI integration servers sit at the top of the operator's priority list, above Kubernetes and exposed Docker APIs.

Check

Check whether any AI or automation services are reachable from the internet, especially Ollama, ComfyUI, n8n, Langflow, or Gradio, plus open Docker APIs, Jenkins consoles, and unauthenticated Redis.

Affected

Teams running self-hosted AI and automation tooling exposed online; NadMesh harvests cloud access keys, Kubernetes service account tokens, and AI integration tool access, targeting the credentials rather than the host.

Fix

Put AI and automation services behind authentication or off the public internet, scope cloud and Kubernetes credentials tightly, avoid long lived keys in those workloads, and rotate anything exposed.