N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

Datadog Security Research (building on prior reporting) analyzes the active N4D Linux malware campaign that scans and abuses publicly reachable MCP servers to deliver a Go-based agent (notably 33.8-go-titan) via loader scripts and HTTP endpoints. The report provides static and runtime evidence of broad multi-service scanning, tool invocation (including execute_command), multiple persistence mechanisms, rotated C2 infrastructure (IPs and cdnorigin.net), numerous file and behavioral IOCs (file paths, cron/systemd artifacts, headers, SSH key, SHA-256 hashes), YARA rules, Livehunt rules, and concrete detection/hunting and mitigation recommendations for defenders.