LF3

Both compromises of the first sensor opened with a request to /api/v1/version fingerprinting the build, followed by /api/v1/auto_login and exploitation.

Where a session is required, GET /api/v1/auto_login supplies one on request wherever anonymous login is enabled. A token returned to an unauthenticated caller seconds before the exploit was observed.

LF3 operators exploited Langflow's POST /api/v1/validate/code endpoint, which permits code execution through Python decorators/default argument evaluation during validation.

The loader supports a crontab layer and an unprivileged fake-cron fallback. The fake-cron loop re-fetches C2 content and pipes it to a shell on a fixed interval.

The July 2026 exploit body carried a one-line fetch of /ch from apt-update[.]com piped straight into a shell. The fake-cron persistence loop re-fetches from the C2 and pipes the result to a shell every 180 seconds.

The loader supports a crontab layer and an unprivileged fake-cron fallback. The fake-cron loop re-fetches C2 content and pipes it to a shell on a fixed interval.

Where a session is required, GET /api/v1/auto_login supplies one on request wherever anonymous login is enabled. A token returned to an unauthenticated caller seconds before the exploit was observed.

The loader installs a service through whichever init system is present, trying systemd with Restart=always and falling back to update-rc.d and chkconfig.

The loader supports a crontab layer and an unprivileged fake-cron fallback. The fake-cron loop re-fetches C2 content and pipes it to a shell on a fixed interval.

The privilege-escalation payload is the public dzonerzy proof of concept for CVE-2021-4034, the PwnKit polkit flaw, reached through GCONV_PATH by way of pkexec.

Where a session is required, GET /api/v1/auto_login supplies one on request wherever anonymous login is enabled. A token returned to an unauthenticated caller seconds before the exploit was observed.

The loader installs a service through whichever init system is present, trying systemd with Restart=always and falling back to update-rc.d and chkconfig.

The packed loader commonly arrived as a compressed and base64-wrapped Python blob. Encrypted payloads were decrypted by the loader using openssl and AES-256-CBC with a hardcoded key and IV.

The delivered loader wipes /dev/shm, /tmp, and /var/tmp. Bootstrap commands also included kill lists targeting rival miner and malware process names.

Where a session is required, GET /api/v1/auto_login supplies one on request wherever anonymous login is enabled. A token returned to an unauthenticated caller seconds before the exploit was observed.

In January, the operator ran ps; when it failed, they fell back to a /proc walk listing every process by PID and path, then killed five processes belonging to rival toolsets.

Once running, the loader speaks using a small custom HTTP protocol to apt-update[.]com. Observed calls were GET /ts, GET /cr, GET /dl, and GET /ch.

The proxied python3 channel sent its C&C through 170[.]78[.]97[.]83 on port 8181 for HTTP and 1088 for SOCKS instead of the Cloudflare-fronted C2 domain.

In August 2025, the exploit connected outbound to TCP 8881, received a length-prefixed zlib blob, and executed it. LF3 loaders subsequently fetched payloads from apt-update[.]com.

The August socket stager delivered a Metasploit Meterpreter stage, and the operator held an interactive Meterpreter session on the host before delivering LF3.

LF3 is a cryptomining framework. The delivered miner is XMRig 6.22.2, and mining began after the loader was delivered.