New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

A newly discovered Go botnet, known as NadMesh, has been targeting exposed AI services since early July. The botnet's operator claims to have collected 3,811 unique AWS keys. NadMesh uses a Shodan harvester to identify potential targets, focusing on services such as ComfyUI, Ollama, and Gradio, which are often quickly set up but may not be properly firewalled. These services include image generators, local model runners, and workflow builders. The botnet appears to be searching for cloud keys and Kubernetes tokens. The operator's dashboard provides a counter to track the number of collected keys.