Loading story…
Researchers reported an active campaign exploiting more than 1,000 internet-exposed ComfyUI instances, especially deployments running without authentication and those using unsafe custom nodes or ComfyUI-Manager, to gain unauthenticated remote code execution. The attackers used a purpose-built Python scanning pipeline to sweep cloud IP ranges, identify vulnerable systems, and deploy a payload known as ghost.sh, then monetized access by installing XMRig for Monero mining and lolMiner for Conflux mining while also enrolling compromised hosts into a Hysteria v2 proxy botnet controlled through a Flask-based command-and-control panel.
The operation showed extensive persistence and defense-evasion tradecraft, including fileless execution via memfd_create, process masquerading, an LD_PRELOAD rootkit for process hiding, watchdog-based restoration, scattered backups, and immutable file locking. Investigators also found reinfection mechanisms in newer scanner versions, including a fake "GPU Performance Monitor" custom node that re-downloads the payload every six hours and a poisoned default startup workflow that relaunches it whenever ComfyUI restarts. Infrastructure tied to 77.110.96[.]200 and additional SSH-linked hosts across China Mobile, DigitalOcean, and AWS suggests a broader opportunistic campaign that may overlap with activity targeting other exposed services such as Redis.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
Censys ARC published research detailing the campaign, including the ghost.sh payload, Flask-based command-and-control panel, and persistence and evasion techniques such as memfd_create execution, LD_PRELOAD process hiding, watchdog restoration, and immutable file locking. The report said more than 1,000 exposed ComfyUI instances were being targeted.
Censys identified infrastructure centered on 77.110.96.200, with related SSH-linked hosts in China Mobile, DigitalOcean, and AWS networks. The findings suggested a wider opportunistic exploitation effort, including possible overlap with activity targeting exposed Redis servers.
The campaign's purpose-built scanner reached version 8.2 and added two persistence features: a fake "GPU Performance Monitor" custom node that re-downloads the payload every six hours and a poisoned default startup workflow that re-executes the malware when ComfyUI restarts. These additions strengthened reinfection and long-term access on compromised hosts.
An active campaign targeted internet-exposed ComfyUI deployments, especially unauthenticated instances with unsafe custom nodes or ComfyUI-Manager installed, to achieve remote code execution. Compromised systems were used for Monero and Conflux mining and enrolled into a Hysteria v2 proxy botnet.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcethehackernews.com
Open sourcecensys.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026
Attackers rapidly weaponized **Atlassian Confluence** vulnerability `CVE-2021-26084`, an unauthenticated OGNL injection flaw enabling remote code execution, to compromise internet-facing servers and deploy cryptocurrency miners, web shells, and backdoors. Multiple reports tied a significant share of the activity to the **z0Miner** botnet, which had previously spread through **WebLogic, Elasticsearch, and Jenkins** flaws and reused similar infrastructure, payloads, and tradecraft. On compromised Confluence systems, z0Miner-linked infections downloaded platform-specific scripts and binaries, installed **XMRig** miners, created persistence through fake services, scheduled tasks, or cron jobs, and removed rival miners to monopolize infected hosts. Security researchers also observed broader exploitation beyond z0Miner, including **Muhstik**, **Sysrv-Hello**, **Setag**, **BillGates**, and **Dofloo**-associated payloads, as well as JSP web shells and a fileless PowerShell reverse shell that launched in memory over TCP port `23733`. Fortinet and IronNet reported widespread scanning and continued attacks even after patches were available, with some campaigns using Confluence access for lateral movement, brute-force activity, and additional malware delivery inside private networks. The activity showed how quickly public proof-of-concept code and newly disclosed enterprise software flaws can be operationalized by commodity botnets against systems that often contain sensitive internal documentation.
Aug 14, 2026