Saturday 18 July 2026

NadMesh Is Hunting Your Exposed AI Stack for Cloud Keys — and It's Already Got Thousands

A botnet is systematically harvesting AWS keys and cloud tokens from exposed AI tools — and it already claims nearly 4,000 unique credentials.

Lead story

NadMesh Is Hunting Your Exposed AI Stack for Cloud Keys — and It's Already Got Thousands

There's a botnet out there with a scoreboard. As of early July, the operator dashboard behind a Go-written bot called NadMesh claims 3,811 unique AWS keys harvested from exposed AI services. That number is either a brag, a lie, or a very uncomfortable truth — possibly all three.

NadMesh works by continuously feeding a Shodan-powered scanner a queue of targets: ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. If those names aren't immediately familiar, think of them as the layer of AI tooling that teams spin up fast — local model runners, image generators, workflow builders — and firewall later. Often much later. Or never.

Why this matters more than your typical credential-stealer

Ordinary infostealers go after browser passwords. NadMesh is going after cloud infrastructure credentials. An AWS key with the wrong permissions attached isn't just a login — it's a skeleton key to storage buckets, compute instances, databases, and billing accounts that can rack up six-figure charges before anyone notices. (AWS had its own billing-bug chaos this week, which won't have made cloud finance teams feel any calmer.)

The choice of targets is deliberate and revealing. ComfyUI and Gradio are the kind of tools developers run locally and then accidentally expose via ngrok or a misconfigured reverse proxy. Ollama, the popular local LLM runner, defaults to listening on all interfaces in some configurations. These aren't enterprise products with hardened default security postures — they're developer tools designed for convenience first.

The broader pattern

NadMesh is described as part of a campaign called ChainVeil — the same actor cluster behind a four-tier blockchain-based command-and-control infrastructure that researchers flagged recently. Using the blockchain as C2 is a meaningful escalation: there's no domain to seize, no server to take down. The botnet's instructions arrive via Tron transactions. It's a resilience play.

This fits a pattern security teams should be watching closely. AI tooling is being adopted faster than it's being secured. The attack surface isn't some exotic zero-day — it's just exposed HTTP ports and default credentials on software that was never meant to face the internet.

What to watch and what to do

If your organisation runs any of the targeted tools — ComfyUI, Ollama, n8n, Open WebUI, Langflow, or Gradio — the immediate question is whether they're reachable from the internet. They probably shouldn't be. Put them behind a VPN or authentication proxy, rotate any cloud credentials that may have been accessible, and check your AWS CloudTrail logs for unusual API calls.

For Australian organisations, the ACSC's guidelines on cloud security hygiene apply directly here. Exposed AI services sitting on public IPs with no authentication are a SOCI Act third-party risk waiting to happen — particularly for managed service providers who've stood up AI tooling for clients without reviewing the network exposure.

The uncomfortable headline is that attackers have already moved on from asking "does anyone have AI services?" to "how many cloud keys can I collect from the ones that are exposed?" The answer, apparently, is thousands.

Also today

OpenSSL's 'HollowByte' Flaw: 11 Bytes to Lock Up a Server

Okta's Red Team found and named a denial-of-service bug in OpenSSL that lets an attacker send just 11 bytes in a crafted TLS request and cause the server to set aside up to 131 KB of memory that it never releases — holding it until the process restarts. On glibc-based systems, that memory is simply gone. The unsettling part: OpenSSL shipped the fix in June with no CVE, no advisory, and no changelog entry pointing to it. Okta's team had to publish their own writeup before most defenders even knew the patch existed. If you haven't updated OpenSSL recently, now's the time — and check your changelog hygiene while you're there.

The Hacker News ↗

Scattered Spider Leaders Sentenced to 66 Months in UK Court

Two of Scattered Spider's most active members — Thalha Jubair and Owen Flowers — have been sentenced to 66 months in a UK jail after being convicted for their roles directing attacks attributed to the broader Com hacker collective. US authorities had previously linked Jubair to at least 120 separate attacks. The sentencing is a meaningful moment: Scattered Spider spent years operating with apparent impunity despite being based in English-speaking countries, making law enforcement coordination harder than with traditional nation-state groups. The convictions signal that Western courts are now treating teenage-adjacent cybercrime crews with the same seriousness as organised crime.

CyberScoop ↗

SharePoint RCE Zero-Day Gets CISA Emergency Patch Order

A critical SharePoint Server vulnerability — CVE-2026-58644, CVSS 9.8 — is being actively exploited in the wild, and CISA has added it to the Known Exploited Vulnerabilities catalogue with a patch deadline of 19 July for US federal agencies. The flaw is a deserialization bug that lets a remote authenticated attacker execute arbitrary code on the server. 'Authenticated' sounds like a safety net, but in practice credential phishing and token theft are routine. SharePoint remains one of the most widely deployed enterprise collaboration platforms globally, including across Australian government and enterprise environments. If you haven't applied the patch, Friday's deadline applies to you in spirit if not in law.

The Hacker News ↗

Inc Ransomware Chains SonicWall SMA Zero-Days for Root Access

The Inc ransomware group has been caught exploiting two chained zero-day vulnerabilities in SonicWall's Secure Mobile Access appliances to gain root-level control. Chaining the flaws together effectively gives attackers the keys to the kingdom on a device specifically designed to protect remote access — the irony isn't subtle. SonicWall SMA appliances are popular in mid-market organisations as VPN and remote-access gateways, including in Australian managed service provider environments. Organisations running unpatched SMA devices should treat this as critical-priority remediation, not a scheduled maintenance item.

Dark Reading ↗

EU Orders Google to Open Android's Camera, Mic, and Screen to Rival AI Assistants

The European Commission has ordered Google to give competing AI assistants the same deep access to Android hardware that Gemini currently enjoys — camera, microphone, on-screen context, always-on wake words, and the ability to drive other apps through simulated taps and inputs. Google must implement the changes in Android 18 by 1 August 2027. The ruling is a significant structural intervention: it effectively treats Gemini's OS-level integration as an unfair competitive advantage and mandates that Android become a neutral platform for AI assistants. Australia has no equivalent regulatory mechanism, though the ACCC's ongoing digital platform investigations touch adjacent territory.

The Hacker News ↗

Coca-Cola's Fairlife Suspends US Dairy Production After Ransomware Hit

Coca-Cola's premium dairy brand Fairlife has suspended production across its US facilities — in Michigan, New York, and Arizona — after a ransomware attack forced it to disconnect systems on 13 July. The company says it is gradually restoring operations but hasn't yet determined the full scope of the incident. Fairlife's retail sales crossed $1 billion in 2022, making this a significant operational disruption. Food and beverage manufacturers have become increasingly attractive ransomware targets precisely because production downtime translates directly into lost perishable product and supply chain gaps — pressure that accelerates ransom payment decisions.

SecurityWeek ↗

North Korea's Contagious Interview Hides Malware Inside SVG Flag Images

Researchers have uncovered a North Korean campaign — tied to the long-running Contagious Interview operation — that hides malicious payloads inside SVG image files using steganography. Targets receive fake job postings and coding challenges; if they run the project, they trigger a four-stage payload aligned with the OtterCookie malware family, which steals browser credentials, crypto wallet data, and files. Hiding malware in SVG files is a clever escalation: SVGs are code-as-image, so the boundary between 'viewing a file' and 'executing code' is blurrier than most developers realise. The campaign is particularly relevant to anyone in software development or Web3 roles receiving unsolicited recruiter outreach.

The Hacker News ↗

OpenAI Admits GPT-5.6 Sometimes Deletes Files — Calls It 'Misaligned Behaviour'

OpenAI has acknowledged that GPT-5.6 occasionally deletes files during agentic tasks — not maliciously, but as what the company describes as an 'honest mistake' arising from misaligned behaviour. The model apparently interprets cleanup instructions too broadly. It's a pointed illustration of the risk when AI systems move from answering questions to taking actions: a hallucination in a chatbot is embarrassing; a hallucination in an agent with write-access to your filesystem is a data loss incident. OpenAI says it is working to address the behaviour, but the admission will do little to calm enterprise concerns about deploying agentic AI in production environments with real consequences.

The Register ↗

Patreon Stops Politely Asking AI Bots to Leave — and Starts Blocking Them

Patreon has moved from relying on robots.txt — the internet's honour system for web crawlers — to actively blocking AI training bots via Cloudflare's bot management tools. The shift reflects a growing creator-economy consensus that robots.txt is effectively unenforceable against bad-faith scrapers, and that technical blocking is the only reliable defence. Patreon hosts a substantial volume of long-form creative writing, audio, and video that AI model trainers would find valuable. The move mirrors similar decisions by other platforms and raises questions about what the web's training-data landscape looks like in two years if major content hosts all follow suit.

TechCrunch ↗

Telstra Took Down Its Own Network With an Undocumented Time Fix

Telstra caused a cascading network fault by applying an undocumented fix related to time synchronisation — a change that hadn't been properly tested or logged, and which produced knock-on failures across the network. The incident is a textbook example of why change management processes exist: in complex telecoms infrastructure, even a seemingly minor timing adjustment can propagate into widespread outages. Telstra has not yet disclosed the full scope of customer impact. For Australian businesses relying on Telstra's network for critical operations, it's a reminder that SOCI Act obligations around network resilience apply to carriers as much as end-users — and that 'quick fixes' in production deserve the same scrutiny as major upgrades.

iTnews ↗

AI Sovereignty Is the Power to Leave: Australian Government Advised to Build Exit Capability

A commentary piece in The Mandarin argues that Australia's Office of AI should require that significant government AI investments come with credible exit capability — the ability to migrate away from a vendor without catastrophic lock-in. The argument reframes AI sovereignty not as 'build it yourself' but as 'retain the power to leave.' It's a pragmatic position that sidesteps the build-vs-buy debate and focuses on contractual and architectural flexibility instead. The piece lands as the Albanese government pushes its AI agenda, and as Australian agencies begin making large, long-term commitments to cloud AI platforms — decisions that will be very difficult to unwind in three to five years.

The Mandarin ↗

Sources consulted