Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
NadMesh Botnet Analysis: A Product-Grade Threat for the AI Service Era
Malware Families
Excerpt
Overview In early July 2026 we observed a Go-based botnet pushing bot samples onto the internet at scale. It folds scanning, exploitation, and credential/AI-service intelligence harvesting into a single autonomous platform. Because its controller calls itself n4d mesh controller in the source, we named it NadMesh . NadMesh is not a one-off worm outbreak. It is a continuously iterated, autonomous botnet aimed squarely at AI infrastructure and the MCP ecosystem. What sets it…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 31c69b3e12936abca770d430066f379ec1d997ec | High | Score 56/100 | First seen |
| CVE | CVE-2016-0638 | Medium | Score 54/100 | First seen |
| IP | 209.99.186.235 | High | Score 66/100 | First seen |
| Domain | cdnorigin.net | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…