Loading story…
TrendAI researchers disclosed LF3, an unreported cryptomining and persistence framework targeting internet-exposed Langflow AI-workflow deployments through the POST /api/v1/validate/code endpoint. Honeypot telemetry logged 1,180 exploitation requests between May 2025 and July 2026, with LF3 operating across four build channels and producing three successful compromises on two sensors. The activity follows prior exploitation of Langflow’s critical CVE-2025-3248, which had been used to deploy the Flodrix botnet.
LF3 uses apt-update[.]com for custom HTTP command-and-control, installs a shell-based loader, attempts PwnKit privilege escalation, creates layered persistence, and deploys stock XMRig to mine Monero. Researchers cautioned that payloads sent to the code-validation route cannot be reliably assigned to CVE-2025-3248, CVE-2026-0770, or CVE-2026-0768 based solely on request structure because the vulnerabilities overlap on that endpoint; defenders should instead hunt for LF3’s C2 protocol and domain, stable configuration schema, hardcoded AES material, and loader artifacts.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
A July LF3 compromise used an inline bootstrap that retrieved a loader from apt-update[.]com/ch and piped it directly to a shell.
An attacker gained access to a Langflow canary through CVE-2025-3248 and deployed a proxy agent, Chisel SOCKS5 tunnel, and pearl-miner XMR cryptominer. The operator later disabled auditd, exploited CVE-2026-0769 for persistence, scanned for additional targets, and pivoted over SSH.
A January LF3 compromise involved an interactive reverse shell, operator-led process enumeration and termination of competing malware, followed by manual deployment of the LF3 loader.
An LF3-related compromise used a socket stager connecting to 185[.]213[.]26[.]27 on TCP port 8881, followed by a Metasploit Meterpreter stage.
TrendAI honeypots recorded Langflow POST /api/v1/validate/code exploitation activity beginning May 13, ultimately capturing 1,180 requests from 70 source addresses through July 31, 2026.
The apt-update.com domain later used by the LF3 framework for custom HTTP command-and-control was registered.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcetrendaisecurity.com
Open sourcetrendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported a Linux cryptomining intrusion tied to `CVE-2026-33017` in Langflow that deployed a Bash dropper, `isp.sh`, and a Go-based ELF payload, `lambsys`, to mine Monero. The dropper fetched the payload from `83[.]142[.]209[.]214`, stored it as `/var/tmp/.xlamb`, executed it, and established persistence. Researchers said the 2026 `lambsys` build reflects an actively maintained malware family dating back to at least May 2024, with updated packing, revised C2 communications, and a multistage delivery chain that has helped keep antivirus detection low. The malware then spread laterally in a worm-like fashion over SSH by reusing credentials and trust material found in `~/.ssh`, `known_hosts`, and SSH agent data, turning single-host compromise into broader exposure across connected Linux systems. Trend Micro said `lambsys` also killed competing miners, swept mining ports, abused PID files, deleted wallet files and backdoor users such as `akay` and `vfinder`, and disabled defenses including the NMI watchdog, `ufw`, `iptables`, AppArmor, SELinux, and Alibaba Cloud's `aliyun.service`; the company warned that incidents involving `lambsys` should be treated as SSH key exposure events, while noting the tradecraft appears inherited from the older KORKERDS/MALXMR lineage rather than conclusively tied to the same operators.
Jun 29, 2026
Multiple vulnerabilities in **Langflow** have exposed AI application deployments to both account-to-account abuse and active compromise. **`CVE-2026-33760`** affects versions before **1.9.0** and allows authenticated users to read, modify, rename, or delete other users’ messages, sessions, build artifacts, and LLM transaction logs through seven `/api/v1/monitor` endpoints that fail to enforce ownership checks. A separate flaw, **`CVE-2026-55255`**, affects versions before **1.9.2** and lets an authenticated attacker execute another user’s flow through the `/api/v1/responses` endpoint by supplying a victim `flow_id`, giving the issue a critical **CVSS 9.9** rating. At the same time, defenders are tracking a cryptocurrency-mining campaign exploiting **`CVE-2026-33017`**, an unauthenticated remote code execution bug in Langflow, to compromise exposed instances and deploy Monero miners. Threat research says the malware disables security controls, installs persistence, and can enable lateral movement through reused SSH keys; observed infrastructure includes **`83.142.209.214`** and **`94.156.64.241`**. Organizations running Langflow are being urged to upgrade to **1.9.0** and **1.9.2** or later as applicable, verify access-control enforcement, restrict public exposure of Langflow services, and treat signs of miner activity or unauthorized flow execution as a significant incident.
Jun 30, 2026
Attackers are actively exploiting **CVE-2025-3248**, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized **Gafgyt/BASHLITE** malware variant on **x86_64 Linux** systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement. The malware reportedly supports multiple flood modes, including **UDP**, **TCP**, **HOLD**, and **junk/STD**, and uses a modified **RC4-based** cipher to obscure command-and-control traffic and hinder standard decoding. **CISA** added `CVE-2025-3248` to its Known Exploited Vulnerabilities catalog, while **GreyNoise** observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a **WAF**, enforce outbound filtering including blocking unauthorized traffic such as port `1337`, and deploy **YARA** detections keyed to the malware’s distinctive cipher seed bytes.
Jul 22, 2026