Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Langflow RCE Flaw Exploited to Deploy Monero Cryptominer on AI Servers
Malware Families
Excerpt
A critical unauthenticated remote code execution (RCE) vulnerability in Langflow, tracked as CVE-2026-33017 , is being actively exploited in a cryptocurrency-mining campaign that silently deploys a Monero cryptominer on internet-exposed AI servers. Documented by Trend Micro’s TrendAI Research, the flaw carries a CVSS v4.0 score of 9.3 and affects all Langflow versions prior to 1.9.0, with exploitation observed in the wild within 20 hours of public disclosure. The flaw…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-33017 | High | Score 67/100 | First seen |
| URL | http://83.142.209.214:8080/isp.sh | High | Score 58/100 | First seen |
| CVE | CVE-2025-3248 | High | Score 79/100 | First seen |
| MD5 | 46096a72d84db5f1dafd944fcf6571c8 | Medium | Score 53/100 | First seen |
| IP | 83.142.209.214 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…