NadMesh: Autonomous AI-Focused Botnet Targeting Cloud and AI Infrastructure (Campaign)

NadMesh is a centralized, large-scale malware campaign that scans and exploits exposed infrastructure and AI-related services discovered via Shodan using over 20 attack vectors. It establishes persistence (SSH keys, hidden binaries, cron jobs), collects cloud credentials, Kubernetes service account tokens, Docker configuration and environment data, inventories deployed AI models and MCP services, and exfiltrates the information to a command-and-control server while supporting periodic rescanning and basic honeypot avoidance.