TrendAI™ Advances Threat Hunting to Dynamic, Real-World Exploitation of AI Infrastructure

TrendAI Research's threat-hunting component observed and analyzed LF3, a cryptomining framework exploiting Langflow RCE: the report details honeypot collection methodology, classification of 1,180 exploit attempts and 3,228 C&C registrations across multiple build channels, the LF3 manifest/schema and constant AES key/IV, a four-call HTTP C&C protocol (apt-update.com), recovery and static analysis of delivered binaries (XMRig and a PwnKit PoC), persistence mechanisms, detection pitfalls, and a defanged table of IoCs for retrospective sweeping.