Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens A Go botnet called NadMesh turned up in early July hunting exposed AI services, and the operator's own dashboard claims 3,811 unique AWS keys. A Shodan harvester keeps the scan queue stocked with ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio: the image generators, local model runners, and workflow builders that teams stand up fast and firewall late. The intel feed behind that counter …

https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html

sha256:b578161c2469f47d90055726283139e4404a3ed420a1d6a44f3810836963f10a

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve4
md50
url0
ipv41
ipv60
sha11
domain3
sha2560
malware_token0
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-39987	Open →
domain	config.json	Open →
cve	CVE-2022-22947	Open →
ip	209.99.186.235	Open →
domain	rc.noauth	Open →
domain	cdnorigin.net	Open →
sha1

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Scattered Spider

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports