This Go Botnet Is Hunting Exposed AI Services for AWS Keys and Kubernetes Tokens

Emily Davis · 2026-07-17

In early July, a new Go-based botnet called NadMesh surfaced, and it's already making waves. The operator's own dashboard claims 3,811 unique AWS keys have been harvested. That number might seem small, but it's a wake-up call for anyone running AI services without proper security. ### How NadMesh Finds Its Targets The botnet relies on a Shodan harvester to keep its scan queue full. It's specifically targeting popular AI tools that teams often deploy quickly but forget to secure. These include: - ComfyUI for image generation - Ollama for running local models - n8n for workflow automation - Open WebUI for AI interfaces - Langflow for building language model workflows - Gradio for machine learning demos The problem is that these tools are designed for speed. Teams stand them up fast, and firewalls often come later. That creates a perfect hunting ground for attackers. ### The Real Risk: Cloud Keys and Tokens If NadMesh finds an exposed service, it doesn't just poke around. It goes straight for cloud keys and Kubernetes tokens. Once an attacker has those, they can spin up expensive compute resources in your account, access sensitive data, or even pivot deeper into your network. The 3,811 AWS keys mentioned on the dashboard? That's not a boast. It's a tally of actual keys the botnet has already grabbed. And it's likely growing every day. ### Why AI Services Are a Prime Target AI workloads are resource-intensive. They often run on powerful GPUs in the cloud, which makes them expensive. Attackers know this. If they can hijack your AI service, they can use your compute power for their own purposes, like mining cryptocurrency or running other malicious campaigns. Plus, these services are often connected to broader cloud environments. A single exposed API key can give an attacker access to your entire AWS or GCP account. The damage potential is huge. ### What You Can Do Right Now If you're running any of the tools NadMesh targets, don't panic. But do take these steps: - **Audit your exposed services.** Use Shodan or a similar tool to check what's visible from the internet. - **Lock down your firewalls.** Make sure only trusted IP addresses can access your AI services. - **Rotate your keys.** If you suspect any keys have been compromised, generate new ones immediately. - **Monitor your cloud bills.** Unusual spikes in compute usage could indicate a hijacked service. ### The Bottom Line NadMesh is a reminder that convenience and security don't always go hand in hand. The tools we love for their speed and flexibility can become liabilities if we don't secure them properly. But with a few simple steps, you can make yourself a much harder target. Stay vigilant, keep your services locked down, and always assume someone is watching.