NadMesh Botnet: Go-Based AI Infrastructure Credential Harvester — OTX Pulse Analysis & Enterprise Detection Pack

---
title: NadMesh Botnet - Kubernetes Service Account Token Access by Non-System Process
description: Detects reads of Kubernetes service account token material by processes outside expected system daemons, consistent with NadMesh credential harvesting behavior (OTX pulse 2026-08-16).
status: experimental
date: 2026/08/16
author: Security Arsenal Threat Intelligence
logsource:
    category: file_access
    product: linux
detection:
    selection_path:
        TargetFilename|contains: '/var/run/secrets/kubernetes.io/serviceaccount/'
    filter_legit:
        Image|startswith:
            - '/usr/bin/kubelet'
            - '/usr/local/bin/kube-proxy'
    condition: selection_path and not filter_legit
falsepositives:
    - Legitimate in-pod applications reading their own projected tokens
level: high
tags:
    - attack.credential_access
    - attack.t1552
    - nadmesh
---
title: NadMesh Botnet - Cloud Instance Metadata Service Access via Curl or Wget
description: Detects command-line HTTP clients querying the cloud metadata service, a technique NadMesh uses to harvest IAM/instance credentials after exploitation.
status: experimental
date: 2026/08/16
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith:
            - '/curl'
            - '/wget'
    selection_cli:
        CommandLine|contains: '169.254.169.254'
    condition: all of selection_*
falsepositives:
    - Cloud-init and provisioning scripts during instance bootstrap
    - SRE diagnostics
level: medium
tags:
    - attack.credential_access
    - attack.t1552.005
    - nadmesh
---
title: NadMesh Botnet - Outbound Connection to Known C2 Domain
description: Detects network connections to the NadMesh C2 domain cdnorigin.net, which masquerades as CDN traffic.
status: experimental
date: 2026/08/16
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
    product: any
detection:
    selection:
        query|contains: 'cdnorigin.net'
    condition: selection
falsepositives:
    - None expected; domain is associated with botnet C2
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - nadmesh

// NadMesh Botnet Hunt — C2 egress, hash execution, and metadata-service credential access
// Microsoft Sentinel / Defender XDR — OTX Pulse 2026-08-16
let NadMeshHashes = dynamic([
    "ca024acead8f54cfe5b07ac4bdf7fcea",
    "31c69b3e12936abca770d430066f379ec1d997ec",
    "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482"
]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has "cdnorigin.net"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType, SignalSource = "C2_Egress"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where MD5 in~ (NadMeshHashes) or SHA1 in~ (NadMeshHashes) or SHA256 in~ (NadMeshHashes)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessAccountName, SignalSource = "Hash_Match"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has "169.254.169.254"
      and FileName in~ ("curl", "wget", "curl.exe", "wget.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, SignalSource = "IMDS_Access"
)
| sort by TimeGenerated desc

# NadMesh Botnet IOC & Persistence Hunt — Security Arsenal
# Run elevated on suspect Linux-adjacent Windows hosts via WSL/SSH or adapt for fleet EDR sweep

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Hash-based file hunt (NadMesh payload artifacts)
$hashes = @(
    'ca024acead8f54cfe5b07ac4bdf7fcea',
    '31c69b3e12936abca770d430066f379ec1d997ec',
    'fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482'
)
Get-ChildItem -Path 'C:\','D:\' -Recurse -File -Force | ForEach-Object {
    $h = Get-FileHash $_.FullName -Algorithm SHA256
    if ($hashes -contains $h.Hash.ToLower()) {
        $report += "[HASH MATCH] $($_.FullName) SHA256=$($h.Hash)"
    }
}

# 2. Network connections / DNS cache check for C2 domain
$dns = Get-DnsClientCache | Where-Object { $_.Entry -like '*cdnorigin.net*' }
if ($dns) { $report += "[C2 DNS] cdnorigin.net resolved on this host: $($dns | Out-String)" }

$conns = Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc.ProcessName -notin @('chrome','msedge','firefox','svchost','System')) {
        $report += "[NET] PID $($_.OwningProcess) $($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"
    }
}

# 3. Persistence artifacts — scheduled tasks & services with suspicious Go-binary traits
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'tmp|appdata|programdata' -and $_.TaskPath -notlike '\Microsoft*'
} | ForEach-Object { $report += "[TASK] $($_.TaskName) -> $($_.Actions.Execute)" }

Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'tmp|appdata|programdata' -and $_.State -eq 'Running'
} | ForEach-Object { $report += "[SERVICE] $($_.Name) -> $($_.PathName)" }

# 4. Kubernetes / cloud credential artifacts on disk
$kPaths = @("$env:USERPROFILE\.kube\config", "$env:USERPROFILE\.docker\config.json", "$env:USERPROFILE\.aws\credentials")
foreach ($p in $kPaths) {
    if (Test-Path $p) { $report += "[CRED AT RISK] $p exists — rotate if host shows other hits" }
}

$report | Out-File "NadMesh_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"
$report | Format-List