NadMesh Botnet Analysis: Product-Level Threat in the AI Services Era
released on 2026-07-20 @ 02:51:14 PM
In July 2026, a sophisticated Go-based botnet named NadMesh was discovered actively deploying across the internet. Unlike traditional worms, it integrates autonomous scanning, exploitation of 20+ vulnerabilities, and targeted harvesting of AI infrastructure credentials. The botnet specifically targets AI services including ComfyUI, Ollama, and MCP ecosystems using Shodan intelligence to prioritize high-value assets. It features a web-based control panel, multi-stage persistence mechanisms including SSH backdoors and cron watchdogs, and polymorphic builds using Garble obfuscation and UPX compression. The operation demonstrates product-grade engineering with automated feedback loops for task generation, honeypot avoidance, and credential extraction from cloud environments, Kubernetes clusters, and AI model services.