A new botnet spotted spreading since early July 2026 is doing something unusual for malware of its kind: instead of scanning the entire internet blindly, it lets a search engine do the legwork first. Researchers at XLab have named the threat NadMesh, a Go-based botnet that leans on Shodan’s indexing of internet-facing devices to locate exposed AI and automation infrastructure before striking.

A Search-Engine-Assisted Hunt for AI Servers

Traditional botnets tend to spray exploit attempts across huge swaths of IP space and hope something answers. NadMesh skips most of that guesswork. A dedicated reconnaissance component, reportedly named ai_harvest.py, queries the Shodan API directly for services like ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. Once a live instance turns up, its address gets pushed straight to the top of NadMesh’s scanning queue.

That shortcut matters. By letting Shodan do the discovery work, the operators avoid burning time and bandwidth scanning dead address space, and can instead focus compromise attempts on servers that are confirmed to be running exploitable AI tooling. It’s a pattern security teams have seen growing across cloud environments generally, where automated scanners increasingly prioritize live, unauthenticated services over brute-force sweeps.

A Five-Stage, Commercial-Grade Operation

What sets NadMesh apart from garden-variety botnets is how deliberately it’s engineered. XLab describes the operation running through five coordinated phases: intelligence gathering, centralized control, automated task distribution, on-the-fly binary building, and delivery. A central controller communicates over ports 80 and 8443 using HMAC-authenticated beacons, and reportedly comes with a web-based management dashboard offering conversion-funnel style analytics and real-time visibility into the bot fleet — features that wouldn’t look out of place in legitimate enterprise software.

Once a machine is compromised, NadMesh doesn’t rely on a single point of persistence. It reportedly plants SSH authorized-key backdoors, duplicates its own binaries in hidden locations, and sets up cron-based watchdog processes, so that removing one artifact doesn’t kill the infection.

More Than 20 Ways In

The malware’s exploitation toolkit is broad, spanning more than 20 distinct vectors. Reported targets include MCP JSON-RPC tool calls, Kubernetes pod creation abuse, Docker API container escapes, unauthenticated Redis instances, Elasticsearch remote code execution, Jenkins Script Console access, and older bugs like WebLogic deserialization flaws. Scans reportedly cover 30 different ports, with AI-specific services given priority — including port 8188 (ComfyUI), 11434 (Ollama), 5678 (n8n), and 7860 (Gradio).

• MCP servers: abused via JSON-RPC tool-call chains leading to command execution
• Kubernetes clusters: malicious pod creation combined with hostPath mount overrides
• Docker hosts: privileged container creation used to escape to the underlying host
• Redis deployments: unauthenticated CONFIG SET commands abused for arbitrary file writes

The Real Prize: Data, Not Compute

Unlike botnets built purely to rent out compromised compute for cryptomining or DDoS, NadMesh appears far more interested in what it can extract. Reported harvests include AWS access keys, Amazon Bedrock credentials, Kubernetes ServiceAccount tokens with cluster-admin scope, local Docker configuration files, inventories of locally hosted AI models such as Llama2 and Mistral, and even active GPT-4 API tokens. It also reportedly captures configuration details for internal MCP tools like execute_sql and execute_shell — effectively mapping out how much control an attacker could exert over an organization’s AI pipeline.

All of that harvested intelligence funnels back to the operator’s dashboard, which tracks compromised certificate counts, exploitable MCP flaws, and escapable Docker hosts. For the people running NadMesh, that map of high-value access may be worth considerably more than the compute power of the machines themselves.

Built to Dodge Detection

To stay ahead of signature-based defenses, NadMesh reportedly uses Garble obfuscation and UPX compression so each deployed binary carries a unique hash. It’s also said to include a honeypot-avoidance feature that blacklists any address failing to yield a successful infection after ten attempts — a small but telling sign of how deliberately this operation has been tuned.

What Organizations Should Do

Teams running AI or MCP infrastructure — ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio, or similar tools — should treat any internet-facing exposure as an immediate risk. Recommended steps include auditing which of these services are reachable from the public internet, enforcing authentication on Redis, Docker, and Kubernetes management interfaces, rotating cloud and model API credentials on any potentially exposed host, and monitoring for the indicators of compromise tied to this campaign, including the reported command-and-control node at 209.99.186.235 and the domain cdnorigin.net.

NadMesh is a reminder that as organizations rush to stand up AI infrastructure, attackers are just as quick to build tooling that specifically targets it — and increasingly, they’re using the same discovery tools defenders rely on to find their own blind spots.