From 17,000 to 1.1 Million Assets: How Lumen Technologies Rebuilt Exposure Management at Scale

A Go-based botnet named NadMesh is actively scanning exposed AI service endpoints (ComfyUI, Ollama, n8n, Open WebUI, Langflow, Gradio) to harvest cloud credentials (including AWS keys) and Kubernetes tokens; QiAnXin XLab published analysis and operator dashboard screenshots showing thousands of keys, dozens of credential hauls and model inventories, and large deployment/scan counts.