Full Report
NadMesh uses a centralized controller to coordinate scanning across large IP ranges and attempts exploitation using more than 20 supported attack vectors. The malware targets exposed services such as Docker APIs, Kubernetes APIs, Redis, Elasticsearch, Jenkins, WebLogic, and MC...
Analysis Summary
# Tool/Technique: NadMesh
## Overview
NadMesh is a sophisticated, autonomous botnet campaign designed to target cloud and AI-oriented infrastructure. It utilizes a centralized controller architecture to orchestrate large-scale scanning and exploitation of misconfigured or exposed services. The primary objective appears to be data exfiltration, specifically targeting cloud credentials, AI model configurations, and service account tokens.
## Technical Details
- **Type:** Malware Family / Botnet
- **Platform:** Linux, Cloud Environments (Docker, Kubernetes)
- **Capabilities:** Autonomous coordination, vulnerability exploitation, credential harvesting, AI-service discovery.
- **First Seen:** July 2026 (Reported)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1190 - Exploit Public-Facing Application]
- **[TA0003 - Persistence]**
- [T1053.003 - Scheduled Task/Job: Cron]
- [T1098.004 - Account Manipulation: SSH Authorized Keys]
- **[TA0007 - Discovery]**
- [T1046 - Network Service Scanning]
- [T1613 - Container and Resource Discovery]
- **[TA0006 - Credential Access]**
- [T1552.001 - Unsecured Credentials: Files]
- **[TA0010 - Exfiltration]**
- [T1041 - Exfiltration Over C2 Channel]
## Functionality
### Core Capabilities
- **Coordinated Scanning:** Uses a centralized controller to manage scanning tasks across extensive IP ranges.
- **Multi-Vector Exploitation:** Supports over 20 distinct attack vectors targeting common cloud services (Docker, Kubernetes, Redis, Elasticsearch, Jenkins, WebLogic).
- **Service Discovery:** Uses Shodan to identify and queue targets, specifically prioritizing AI-related services like Ollama, ComfyUI, Langflow, and Gradio.
- **Credential Harvesting:** Automatically collects Docker configurations, environment variables, and Kubernetes service account tokens.
### Advanced Features
- **AI Infrastructure Focus:** Specifically seeks out Model Context Protocol (MCP) implementations and information regarding deployed AI models.
- **Honeypot Avoidance:** Includes logic designed to identify and skip suspected honeypots to maintain campaign efficiency.
- **Redundant Persistence:** Employs multiple methods to maintain access, including hidden binaries and modified SSH authorized keys.
## Indicators of Compromise (Network Indicators Defanged)
*Note: Specific file hashes should be referenced via the provided XLAB or Wiz research links for current versions.*
- **Network Indicators:**
- C2 Traffic: Communication with centralized controller nodes (e.g., `*.nadmesh[.]com` or specific hardcoded IPs).
- Outbound Scanning: Unusual volume of port scanning originating from internal cloud nodes toward external ranges.
- **Behavioral Indicators:**
- Unexpected modifications to `/root/.ssh/authorized_keys`.
- Creation of unauthorized cron jobs.
- Unusual API calls to Docker/Kubernetes endpoints from unexpected internal IP addresses.
## Associated Threat Actors
- **Currently Unknown:** The campaign exhibits high technical proficiency but has not yet been attributed to a named threat group.
## Detection Methods
- **Behavioral Detection:** Monitor for unauthorized `curl` or `wget` commands fetching scripts from remote IPs to `/tmp` or `/var/tmp`.
- **Anomalous Traffic:** Alert on rapid, sequential connections to ports associated with Docker (2375/2376), Redis (6379), or AI services (e.g., Ollama on 11434).
- **Log Analysis:** Audit Kubernetes and Docker API logs for unauthorized "exec" or "create container" requests originating from non-admin accounts.
## Mitigation Strategies
- **Network Hardening:** Close publicly exposed Docker and Kubernetes APIs; ensure they are only accessible via VPN or authenticated proxy.
- **Identity & Access Management:** Implement the principle of least privilege for Kubernetes service accounts and Docker configurations.
- **Service Security:** Enable authentication for all internal databases and services (Redis, Elasticsearch) even if they are not intended to be public-facing.
- **Scanning:** Regularly scan cloud environments for shadow AI services (Gradio, ComfyUI) that developers may have deployed without security oversight.
## Related Tools/Techniques
- **TeamTNT:** Known for similar cloud-native botnets and Docker/K8s exploitation.
- **Kinsing:** Frequently targets misconfigured Redis and Docker instances for resource hijacking.