OTX Threat: NadMesh Botnet Analysis: Product-Level Threat in the AI Services Era

In July 2026, a sophisticated Go-based botnet named NadMesh was discovered actively deploying across the internet. Unlike traditional worms, it integrates autonomous scanning, exploitation of 20+ vulnerabilities, and targeted harvesting of AI infrastructure credentials. The botnet specifically targets AI services including ComfyUI, Ollama, and MCP ecosystems using Shodan intelligence to prioritize CVEs: CVE-2016-0638 Sectors: Technology