datadog-security-labs · Crawled Sep 7, 2026
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
24 IoCs 5 CVEs
Read original article ↗
AI Summary
The N4D Mesh Controller is an active Linux malware campaign that exploits exposed Model Context Protocol (MCP) servers to enable credential theft, lateral movement, persistence, and command and control. The campaign uses a UPX-packed Go-based agent named 'go-titan' that communicates with controllers via custom headers and supports secondary C2 through Cloudflare Quick Tunnels. The agent targets AI and infrastructure services including Ray Dashboard, LightLLM, PostgreSQL, Redis, Kubernetes, and Jenkins, using automated scanning and exploitation techniques.
AI-extracted · verify before operational use
Extracted Entities 5 found
Indicators of Compromise 24 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 209[.]99[.]186[.]235 | Details → |
| IP | 209[.]99[.]186[.]73 | Details → |
| Domain | cdnorigin[.]net | Details → |
| Domain | *[.]trycloudflare[.]com | Details → |
| Filename | /etc/cron.d/.sys-health | Details → |
| Filename | /etc/profile.d/.sys_alias.sh | Details → |
| Filename | /etc/systemd/system/sys-resource.service | Details → |
| Filename | /tmp/.sys-health-monitor.tmp | Details → |
| Filename | /dev/shm/.n4d | Details → |
| Filename | /var/tmp/.a | Details → |
| Filename | /var/tmp/.wd | Details → |
| Filename | /tmp/.n4d_autodeploy_debug | Details → |
| SHA-256 | fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482 | Details → |
| SHA-256 | c422621ef824b627d74906f8d75ed8f990f4d6c708a0d263f219f9d9dd435174 | Details → |
| SHA-256 | 3435cc9d4a255bfb4cfb09f2390c29b888f70a43345cfaaecf46c55bc89b814d | Details → |
| SHA-256 | 0d5f67b6d35e609e1d5eac0afd981147ea8df7da2f192ae59ac0bab7e48cc1de | Details → |
| SHA-256 | 77fe750d6b94b32e80e25aecb2ae7c435f0b45cfca25969dbee4dc22967b1302 | Details → |
| SHA-256 | 94ae566e27b176698958b4b9c216a0a2b0ac7ce11d7d81417c8add081fd3cc9c | Details → |
| SHA-256 | d4483b7a943faeec2ce6690e508ee3a30c7fc1e546887658921c132f179b8e78 | Details → |
| SHA-256 | 749e8835bb407336742f3fff5f81ba5eb476a42dfc0246f1107d4f28f1bea708 | Details → |
| SHA-256 | 79e44b8523ee1e371436ca36e91d4d6f932beb371e7d77de756ffdd8f825e763 | Details → |
| SHA-256 | e09ac5e8c23a768a2370cff29aca64be0d6e210e1176ee526bb7e47f537509ae | Details → |
| GitHub Repo | n4d-agent/loader | Details → |
| Registry User | n4d-2ff16c75b1d2 | Details → |
MITRE ATT&CK TTPs 16 techniques
T1071.001 Web Protocols · Command And Control T1021 Remote Services · Lateral Movement T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1078 Valid Accounts · Defense Evasion T1078.001 Default Accounts · Defense Evasion T1090 Proxy · Command And Control T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1210 Exploitation of Remote Services · Lateral Movement T1220 XSL Script Processing · Defense Evasion T1484 Domain or Tenant Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1566 Phishing · Initial Access T1588.001 Malware · Resource Development T1659 Content Injection · Initial Access