NadMesh Botnet Targeting AI Infrastructure: OTX Pulse Analysis — Credential Theft Detection Pack

title: NadMesh Botnet C2 Network Traffic
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects network connections to known NadMesh C2 infrastructure identified in OTX Pulse.
references:
    - https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era
author: Security Arsenal
date: 2026/07/22
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationIp:
            - '209.99.186.235'
        DestinationHostname:
            - 'cdnorigin.net'
    condition: selection
falsepositives:
    - Legitimate administrative access (unlikely given domain nature)
level: critical
---
title: NadMesh Botnet Malicious File Execution
id: b2c3d4e5-6789-01ab-cdef-234567890abc
status: experimental
description: Detects execution of the NadMesh Go binary based on known file hashes.
references:
    - https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era
author: Security Arsenal
date: 2026/07/22
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Hashes|contains:
            - 'ca024acead8f54cfe5b07ac4bdf7fcea'
            - '31c69b3e12936abca770d430066f379ec1d997ec'
            - 'fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Potential Redis Exploitation CVE-2016-0638
id: c3d4e5f6-7890-12bc-def0-345678901bcd
status: experimental
description: Detects potential exploitation of Redis Lua sandbox escape used by NadMesh for initial access.
references:
    - https://blog.xlab.qianxin.com/nadmesh-botnet-analysis-a-product-grade-threat-for-the-ai-service-era
author: Security Arsenal
date: 2026/07/22
logsource:
    category: database
    product: redis
detection:
    selection_keyword:
        Command|contains:
            - 'eval'
            - 'script load'
    selection_suspicious:
        Command|contains:
            - 'package.loadlib'
            - 'io.popen'
    condition: all of selection_*
falsepositives:
    - Legitimate Lua scripting in Redis (rare)
level: high


kql
// Hunt for connections to NadMesh C2 infrastructure
DeviceNetworkEvents
| where RemoteIP == "209.99.186.235" or RemoteUrl contains "cdnorigin.net"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl

// Hunt for execution of NadMesh binary hashes
DeviceProcessEvents
| where SHA256 == "fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482" 
   or MD5 == "ca024acead8f54cfe5b07ac4bdf7fcea"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName

// Hunt for Redis anomalies on Linux hosts (if Syslog/SecurityEvent is ingested)
DeviceProcessEvents
| where ProcessVersionInfoCompanyName == "Redis" or FileName contains "redis-server"
| where ProcessCommandLine contains "eval" and ProcessCommandLine contains "package.loadlib"
| project Timestamp, DeviceName, ProcessCommandLine


bash
#!/bin/bash
# NadMesh IOC Hunt Script for Linux Endpoints
# Checks for the presence of NadMesh file hashes on the system

echo "[*] Starting NadMesh IOC Hunt..."

KNOWN_SHA256="fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482"
KNOWN_MD5="ca024acead8f54cfe5b07ac4bdf7fcea"

# Scan common execution paths
PATHS_TO_SCAN="/ /tmp /var/tmp /home /root /opt /var/www"

echo "[*] Scanning for SHA256 hash: $KNOWN_SHA256"
find $PATHS_TO_SCAN -type f 2>/dev/null | while read -r file; do
    hash=$(sha256sum "$file" 2>/dev/null | awk '{print $1}')
    if [ "$hash" = "$KNOWN_SHA256" ]; then
        echo "[ALERT] NadMesh binary found at: $file"
    fi
done

echo "[*] Scanning for MD5 hash: $KNOWN_MD5"
find $PATHS_TO_SCAN -type f 2>/dev/null | while read -r file; do
    hash=$(md5sum "$file" 2>/dev/null | awk '{print $1}')
    if [ "$hash" = "$KNOWN_MD5" ]; then
        echo "[ALERT] NadMesh binary found at: $file"
    fi
done

echo "[*] Checking for active connections to C2 IP 209.99.186.235..."
netstat -antp 2>/dev/null | grep "209.99.186.235" && echo "[ALERT] Active connection to NadMesh C2 detected!" || echo "[INFO] No C2 connections found."

ss -antp 2>/dev/null | grep "209.99.186.235" && echo "[ALERT] Active connection to NadMesh C2 detected!" || echo "[INFO] No C2 connections found."

echo "[*] Hunt complete."