News › security
By Zayden R., July 19, 2026
NadMesh, a Go-based botnet, has been discovered targeting exposed AI services for AWS keys and Kubernetes tokens. The botnet uses Shodan to scan for unsecured services, posing a significant risk to cloud infrastructure.
A new botnet named NadMesh has emerged, targeting exposed AI services in a hunt for cloud keys and Kubernetes tokens. Discovered in early July, the botnet is written in Go and has already claimed 3,811 unique AWS keys, according to the operator's dashboard. This development is particularly concerning for teams that rapidly deploy AI services without adequate security measures.
NadMesh employs a Shodan harvester to keep its scan queue full, searching for services like ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. These are popular tools for image generation, local model execution, and workflow building, often spun up quickly and secured later, if at all. The botnet's focus on these services underscores the importance of securing cloud-based AI infrastructure from the outset.
The botnet's capacity to mine sensitive credentials from poorly protected services poses a substantial threat to cloud environments. As AI tools become more integral to operations, the security practices around their deployment need to evolve accordingly. This is a solid reminder for sysadmins to enforce stringent firewall rules and regularly audit their cloud configurations to prevent unauthorized access and potential breaches.
The emergence of NadMesh highlights the growing intersection of AI services and cybersecurity threats. It serves as a wake-up call for organizations to prioritize robust security measures in the fast-paced world of AI deployment.