{
  "Event": {
    "analysis": "1",
    "date": "2026-07-17",
    "extends_uuid": "",
    "info": "[Threat Intel] Botnet Analysis: A Product-Grade Threat for the AI Service Era",
    "protected": false,
    "publish_timestamp": "1784588163",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1784588163",
    "uuid": "a40c00d5-bdd7-40e6-9621-1cc3a80c292d",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#e2ba37",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Boot or Logon Initialization Scripts - T1037\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#5c57c8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Vulnerability Scanning - T1595.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#83203e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1136.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#70b0b5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"",
        "relationship_type": ""
      },
      {
        "colour": "#f798db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal from Tools - T1027.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#b596f0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Lateral Tool Transfer - T1570\"",
        "relationship_type": ""
      },
      {
        "colour": "#e12cbc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#50bd28",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b4369",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Container API - T1552.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#120046",
        "local": false,
        "name": "rectifyq:sub-category=\"infra-profile\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005c",
        "local": false,
        "name": "rectifyq:topic=\"ai\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:operating-system=\"Linux\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#220082",
        "local": false,
        "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#230087",
        "local": false,
        "name": "rectifyq:samples-found-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343640",
        "to_ids": false,
        "type": "link",
        "uuid": "c967231c-1921-4771-8a58-21b986f6c365",
        "value": "https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era-en/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343640",
        "to_ids": false,
        "type": "text",
        "uuid": "a865bccc-d006-4bf9-90a9-a45301bb9d92",
        "value": "NadMesh is an industrial-grade Go-based botnet observed in July 2026 that autonomously scans and exploits AI infrastructure and cloud services. The botnet integrates scanning, exploitation, and intelligence harvesting into a single platform targeting over 90 cloud provider address ranges. It employs 20+ exploitation vectors against Redis, Docker, MCP, Kubernetes, and other services, with particular focus on AI platforms like ComfyUI, Ollama, and Gradio discovered via Shodan API. NadMesh features a web-based management panel, polymorphic builds using Garble obfuscation and UPX packing, and redundant persistence mechanisms including SSH backdoors, agent processes, and cron watchdogs. The operation demonstrates clear commercial intent with conversion funnel statistics, canary updates, and automated task supply loops that amplify high-yield subnets. It harvests cloud credentials, Kubernetes tokens, AI model access, and MCP service intelligence."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343640",
        "to_ids": false,
        "type": "text",
        "uuid": "2e305137-37f7-42cf-9b6a-1df244ee9d79",
        "value": "Name: Botnet Analysis: A Product-Grade Threat for the AI Service Era\nAuthor: AlienVault\nAdversary: \nTags: [\"shodan intelligence\", \"credential harvesting\", \"polymorphic\", \"ai infrastructure targeting\", \"mcp exploitation\", \"botnet\", \"autonomous scanning\", \"go-based\", \"kubernetes compromise\", \"nadmesh\", \"cve-2016-0638\"]\nTgtd countries: []\nMlwr families: [\"NadMesh\"]\nAttack_ids: [\"T1037\", \"T1133\", \"T1543.003\", \"T1053.003\", \"T1190\", \"T1595.002\", \"T1552.004\", \"T1098.004\", \"T1552.001\", \"T1136.003\", \"T1110\", \"T1027.005\", \"T1078\", \"T1573\", \"T1570\", \"T1095\", \"T1027.002\", \"T1071.001\", \"T1046\", \"T1552.007\"]\nIndustries: [\"Technology\"]"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784343640",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "7ec33a81-6953-4cee-8667-c8ef1f80deb3",
        "value": "CVE-2016-0638"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784587613",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "0f13547e-54a4-40fe-8422-e839e2bd40ea",
        "value": "209.99.186.235",
        "Tag": [
          {
            "colour": "#32a999",
            "local": false,
            "name": "asn:asn=\"203999\"",
            "relationship_type": ""
          },
          {
            "colour": "#f714d1",
            "local": false,
            "name": "asn:as-owner=\"GEEKYWORKS\"",
            "relationship_type": ""
          },
          {
            "colour": "#8569b9",
            "local": false,
            "name": "asn:as-country=\"IN\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"india\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1784587634",
        "to_ids": true,
        "type": "domain",
        "uuid": "0bd00541-da54-4a68-88e1-1b30aa70c43e",
        "value": "cdnorigin.net",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-07-10T02:44:13+00:00",
        "last_seen": "2026-07-10T02:57:57+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1784587655",
        "uuid": "582deb7b-b0a0-4224-8b91-d6e20879e040",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "md5",
            "timestamp": "1784587655",
            "to_ids": true,
            "type": "md5",
            "uuid": "c7937169-3968-4017-8df3-fd627b5f886a",
            "value": "ca024acead8f54cfe5b07ac4bdf7fcea",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "sha1",
            "timestamp": "1784585120",
            "to_ids": true,
            "type": "sha1",
            "uuid": "8ca217af-d3b3-4f38-b1e9-e1aab57d2664",
            "value": "31c69b3e12936abca770d430066f379ec1d997ec",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "sha256",
            "timestamp": "1784585120",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c6dda32b-45c1-4fdb-8c3b-38cd5fe46515",
            "value": "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#220082",
                "local": false,
                "name": "rectifyq:samples-found-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#230087",
                "local": false,
                "name": "rectifyq:samples-found-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 21/07/2026\nLast-scan: 20/07/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "text",
            "timestamp": "1784584433",
            "to_ids": false,
            "type": "text",
            "uuid": "1d438201-8914-4461-9ab2-a1a9bc4cd9e3",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/Vigorf.A\nClamAV: None\nVT Total Detection: 27/74\nFirst Submission: 2026-07-10T02:44:13+00:00\nLast Submission: 2026-07-10T02:57:57+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1784584433",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "6315f827-5184-4189-9671-c81719e1ccee",
            "value": "98304:/nDRzYyYy1A8DHL9jF9s8e2708vkOWpdjdvp0gBYGmNkM7+80shVtYV+C3m/G9BM:/nDmyYy1hjF9+38vYbjd2Bl0sdi+OQ"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1784584433",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "43124e8a-9c2f-4bf1-a5a6-269d69091ab1",
            "value": "7321596"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "vhash",
            "timestamp": "1784584433",
            "to_ids": true,
            "type": "vhash",
            "uuid": "17c02557-8224-446d-8226-406d0ff7fd86",
            "value": "db91bbecde9c9c8c3cf7a86acc0cad06"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-07-10T02:44:13+00:00",
            "last_seen": "2026-07-10T02:57:57+00:00",
            "object_relation": "filename",
            "timestamp": "1784584433",
            "to_ids": true,
            "type": "filename",
            "uuid": "27546652-b3ab-45c4-856f-d549c8c91c2f",
            "value": "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482.elf"
          }
        ]
      }
    ]
  }
}