NadMesh Botnet Targets AI Services
Threat to cloud keys and Kubernetes tokens
1Emergence of NadMesh Botnet
Emerging in early July, the NadMesh botnet scans exposed AI services to target cloud keys and Kubernetes tokens. It exploits vulnerabilities in popular AI tools like ComfyUI, Ollama, and Gradio.
2Targeted AI Services
NadMesh targets locally run models and workflow builders that are quickly set up but lack timely security measures. These vulnerabilities allow the botnet to access cloud credentials.
3Theft of Cloud Credentials
The botnet steals cloud keys from environment variables, Kubernetes service account tokens, and Docker configuration files. Researchers emphasize that the primary target is cloud credentials.
4Exploitation of Vulnerabilities
NadMesh exploits exposed services like Docker API, Jenkins console, and Redis. These vulnerabilities enable the botnet to carry out successful attacks.
5Scanning and Rescanning Process
The botnet intensively scans target subnets and rescan IP addresses with vulnerabilities. Targets that do not return results are automatically blacklisted.
6Security Measures and Outcome
Effective measures against the NadMesh botnet include placing services behind authentication and closing open ports. Immediate revocation of cloud credentials is also crucial.
Original article: The Hacker News — NadMesh Botnet AI Hizmetlerini Hedef Alıyor