Attackers have shifted from commoditizing GPU cycles to harvesting high-value credentials from exposed AI infrastructure. The NadMesh botnet, discovered by QiAnXin XLab in early July 2026, is the first operation purpose-built to hunt AI services not for their compute, but for the cloud keys and Kubernetes tokens that unlock the broader enterprise environment.
How NadMesh Works
The Go-based botnet takes its name from the “n4d mesh controller” string found in its source code. Its target list is specific: ComfyUI (port 8188), Ollama (port 11434), n8n (port 5678), Open WebUI, Langflow, and Gradio (port 7860). These are the image generators, local model runners, and workflow builders that development teams deploy fast and firewall late.
A Shodan-based harvester keeps the scan queue stocked with AI service targets, assigning them a priority level of 20. Subnets that produce hits get resampled every five minutes. IPs flagged dangerous in the past 24 hours come back every quarter hour as /32 rescans with AI ports checked first. Any target that absorbs ten deployment attempts without returning a result gets auto-blacklisted as a suspected honeypot.
The botnet maintains persistence through three simultaneous mechanisms: SSH authorized_keys injection, hidden binaries in /dev/shm/, /var/tmp/, and /tmp/, and cron watchdogs in /etc/cron.d/. Every build goes through Garble obfuscation, UPX -9 packing, and random padding, meaning no two agents share a hash. Published signatures catch one build and miss the rest.
MCP: The Top-Priority Vector
What distinguishes NadMesh from prior AI-targeting operations is its exploitation of the Model Context Protocol. MCP sits at the top of the controller’s priority order for exploitation, above Kubernetes, Docker API, and Redis. The vector XLab records beside it is a JSON-RPC tools/call to execute_command – no CVE attached, and XLab does not claim one.
This follows the protocol’s design. MCP’s first specification put authentication outside the core protocol entirely. The authorization flow added in March 2025 is still optional in the spec’s own words. Plenty of deployments skip it. As covered in our prior MCP Protocol analysis, these design gaps create a rapidly expanding attack surface.
Censys counted 12,520 reachable MCP services across 8,758 IP addresses as of April 28. By May 6, the number exceeded 21,000. Roughly 90 were advertising a tool that runs commands. On 39 of those, the tool was named execute_command – the exact call at the top of NadMesh’s table. Censys ended its census on May 27 by guessing at the least-bad outcome for all those exposed shell tools: hosts winding up “part of some future botnet or abuse infrastructure.” NadMesh published with mcp_cmd_execute in its exploit chart seven weeks later.
What It Harvests
The operator’s own dashboard claims 3,811 unique AWS keys harvested. The intelligence feed behind that counter shows 47 credential hauls and 41 model inventories in its last 100 records. Those inventories carry DeepSeek, GLM, and Kimi identifiers tagged :cloud, suggesting that what the bots catalogue reaches past the box itself.
XLab researchers put it plainly: the operator is after “not the host itself, but the cloud credentials, Kubernetes cluster privileges” on it. The harvest includes Kubernetes service-account tokens with cluster-admin scope, ~/.aws/config files, .env contents, ~/.docker/config.json, model access tokens, and MCP tool inventories. This is not opportunistic mining. It is targeted credential exfiltration designed to pivot into broader cloud environments.
The Infrastructure Behind It
Five build versions run concurrently, with a canary endpoint staging new builds to a slice of the fleet before full deployment. The exploit traffic XLab actually observed tells a more nuanced story than the dashboard: docker_containers_api_rce takes 30.31%, jenkins_scripttext_rce another 22.28%. Telnet weak passwords account for 10.36%, Redis for 8.29%. The mcp_cmd_execute vector is in XLab’s observed traffic but sits in the unlabeled tail at 0.78%.
The dashboard itself does not reconcile. A counter reading 17,700 total deploys sits above a funnel claiming 95,700 in the past 24 hours. One tile says 16 active bots; the next says 12. The credential number is at least the one it states twice. The panel’s own footnote is the tell: success is scored on an outcome allowlist that explicitly excludes the Ollama and AWS harvest. The operator’s scoreboard does not count the thing the operator is taking.
The Threat Model Arc
The evolution from the April 2026 ComfyUI mining operations to NadMesh demonstrates a clear maturation in criminal targeting of AI infrastructure. What changed is the payoff: the April operator wanted the GPU, and NadMesh wants what the box can log into. This extends the threat model from AI-as-target to AI-toolchains-as-attack-surface – the seventh frame in a pattern that now includes infrastructure defense, containment architecture, protocol vulnerability, and regulatory gaps.
The observation traffic reveals the gap between MCP’s exploitation priority in the controller (top) and in XLab’s sensors (0.78%). The AI targeting is real at the intake and in the loot, and most of the exploit traffic still goes to Docker sockets and Jenkins consoles. This is not a story about MCP being the dominant exploit. It is a story about MCP being the operator’s first choice when it works, combined with commodity infrastructure exploitation to fill the gaps.
What AI Infrastructure Operators Need to Do
Most of what NadMesh throws is aimed at exposed services and admin functionality left callable: open Docker APIs on port 2375, Jenkins script consoles, unauthenticated Redis, weak Telnet and SSH passwords. No patch closes any of those. Get them behind authentication or off the public internet, starting with the four ports the rescan job puts first: 8188 (ComfyUI), 11434 (Ollama), 7860 (Gradio), and 5678 (n8n).
Audit all MCP implementations. Given that the specification makes authorization optional, operators must manually enforce authentication and authorization layers for any service exposing tool execution capabilities. Treat AI infrastructure servers as high-value targets – the presence of .env files and cloud configuration on these machines makes them entry points for lateral movement.
Check the persistence drop paths: ~/.ssh/authorized_keys for keys nobody remembers adding, /dev/shm/.a, /var/tmp/.a, /tmp/.a, and /etc/cron.d/.sys_monitor. If any of that turns up, isolate the host and revoke every credential it could see immediately. Revoking is not rotating. Pull the persistence before issuing replacements, or the new keys go the way of the old ones.