New NadMesh Botnet Uses 20+ RCE Vectors to Hijack AI and MCP Infrastructure

NadMesh is an industrial-grade Go-written botnet observed in July 2026 that autonomously scans and exploits internet-facing cloud and AI services using more than 20 RCE vectors to capture cloud credentials, compromise MCP and AI orchestration stacks, and deploy polymorphic agents with multi-mechanism persistence; the report documents its closed-loop kill chain (intelligence, control, supply, construction, delivery), targeted services (Kubernetes, Docker, Redis, Elasticsearch, AI frontends), automated supply/rescan pipelines, and operational telemetry indicating active, high-volume campaigns against hyperscaler and niche cloud footprints.