NadMesh Botnet Targets AI Services and Cloud Environments

The NadMesh botnet is an autonomous, Go-based malware campaign that scans and exploits exposed cloud and AI infrastructure (including Docker, Kubernetes, Redis, ComfyUI, Ollama, and Gradio), deploys polymorphic payloads, and harvests cloud credentials and model access tokens; researchers observed active infections and a central C2 used to direct scanning and data exfiltration, and defenders are advised to secure cloud endpoints, rotate keys, and monitor for unauthorized SSH keys and cron jobs.