N4D Linux Malware Abuses MCP Tools and Scans for Exposed Services
Summary
Datadog’s analysis of N4D’s 33.8-go-titan agent confirms MCP command-tool abuse, broad autonomous scanning, multiple Linux persistence methods, and controller reporting. The researchers provide indicators and defensive guidance.
Key points
- N4D uses exposed MCP servers as entry points, enumerating tools and calling command-execution capabilities without requiring a software vulnerability.
- The analyzed 33.8-go-titan agent scanned hundreds of destination IPs and probed SSH, databases, Kubernetes, Docker, caches, and other services.
- The agent attempted MCP execute_command with an id command and reported the structured result to its controller; the lab fixture prevented actual command execution.
- Observed persistence includes cron jobs, shell startup changes, systemd services, watchdogs, and an SSH key added to root’s authorized_keys.
- The agent contacts infrastructure including cdnorigin.net and 209.99.186.235, and can use Cloudflare Quick Tunnels as a secondary channel.
- Researchers publish behavioral and host-based hunting leads, YARA rules, indicators, and response guidance, including isolating affected hosts and rotating accessible credentials.
Article Details
- Attack Vectors
- Scans exposed MCP endpoints, requests tools/list, and selects command-execution, file-access, or database-query tools for invocation through tools/call.
- Uses shell scripts and loaders with curl or wget to download architecture-specific agents from cdnorigin.net or the reported IP addresses.
- Autonomously scans adjacent services and public address ranges for exposed databases, container APIs, Kubernetes, caches, application servers, and AI services.
- Uses service-specific abuse paths, including PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, and LightLLM.
- Reports registration, task, result, and host-intelligence data to controller API paths using custom authentication headers.
- Installs overlapping persistence mechanisms including cron entries, shell-profile changes, watchdogs, systemd units, and an SSH authorized key.
- Can launch Cloudflare Quick Tunnels as a secondary communications channel.
- Defensive Notes
- Correlate MCP initialize and tools/list requests from n4d-vps or n with N4D request paths, persistence artifacts, or other campaign indicators.
- Alert on MCP tools/call activity invoking command-execution, file-write, or database-query tools, and on child processes such as curl, wget, shell interpreters, or executables written to temporary directories.
- Monitor for execution from /dev/shm, /tmp, or /var/tmp, including processes named kworker*, and for the article-listed cron, profile, systemd, watchdog, and SSH-key artifacts.
- Monitor connections or DNS/HTTP activity involving 209.99.186.73, 209.99.186.235, and cdnorigin.net; treat *.trycloudflare.com activity as a correlation lead only.
- For response, isolate affected hosts and preserve process trees, executables, scripts, connections, and temporary files before removing persistence; rotate credentials and keys available to the MCP process or host.
- Require authentication for exposed MCP services, restrict remote access, remove unnecessary high-impact tools, and apply per-tool authorization, sandboxing, constrained egress, and invocation logging.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cdnorigin[.]net | Reported TLS-fronted N4D C2 and payload-delivery domain. |
| IPV4 | 209[.]99[.]186[.]235 | Loader and live second-stage delivery infrastructure observed in July 2026. |
| IPV4 | 209[.]99[.]186[.]73 | Reported N4D controller and payload-delivery infrastructure. |
| SHA256 | 0d5f67b6d35e609e1d5eac0afd981147ea8df7da2f192ae59ac0bab7e48cc1de | Statically linked Go loader analyzed in the article. |
| SHA256 | 3435cc9d4a255bfb4cfb09f2390c29b888f70a43345cfaaecf46c55bc89b814d | Unpacked Go debug build identified as an N4D collection file. |
| SHA256 | 749e8835bb407336742f3fff5f81ba5eb476a42dfc0246f1107d4f28f1bea708 | N4D agent watchdog shell script. |
| SHA256 | 77fe750d6b94b32e80e25aecb2ae7c435f0b45cfca25969dbee4dc22967b1302 | Password-protected archive containing the newer N4D loader. |
| SHA256 | 79e44b8523ee1e371436ca36e91d4d6f932beb371e7d77de756ffdd8f825e763 | Architecture-aware N4D downloader shell script. |
| SHA256 | 94ae566e27b176698958b4b9c216a0a2b0ac7ce11d7d81417c8add081fd3cc9c | Password-protected archive containing the supplied packed 33.8-go-titan agent. |
| SHA256 | ab435e3e24cfb3a37c1f564209869fe53c8fe95bc9161d0d373fbc1c551b2c29 | Unobfuscated N4D collection file identified in VirusTotal Livehunt matches. |
| SHA256 | c422621ef824b627d74906f8d75ed8f990f4d6c708a0d263f219f9d9dd435174 | Unpacked form of the 33.8-go-titan agent. |
| SHA256 | d4483b7a943faeec2ce6690e508ee3a30c7fc1e546887658921c132f179b8e78 | UPX-packed Linux agent listed as an N4D tracking indicator. |
| SHA256 | e09ac5e8c23a768a2370cff29aca64be0d6e210e1176ee526bb7e47f537509ae | N4D agent downloader shell script. |
| SHA256 | fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482 | UPX-packed 33.8-go-titan agent retrieved from the reported delivery infrastructure. |
| URL | hxxp[:]//209[.]99[.]186[.]235:8443/api/agent/full?arch=amd64 | Observed URL returning the UPX-packed second-stage agent. |
MITRE ATT&CK
T1036 · MasqueradingThe agent uses process names that mimic Linux kernel workers, including kworker-style names.T1041 · Exfiltration Over C2 ChannelThe agent reports MCP tool-call results and host intelligence to its controller, including through /api/intel.T1046 · Network Service DiscoveryThe agent performed broad multi-service scanning, including runtime connection attempts to 742 destination IPs across 37 ports.T1053.003 · CronThe loader and agent establish persistence with scheduled entries under /etc/cron.d, including .sys-health and .s.T1059.004 · Unix ShellShell scripts download and launch the agent, and the agent's MCP interaction attempted to invoke execute_command with an id command in the offline replay.T1071.001 · Web ProtocolsThe agent communicates with its controller through HTTP API paths such as /api/register, /api/task/, /api/result/, and /api/intel.T1090.003 · Multi-hop ProxyThe agent can launch Cloudflare Quick Tunnels and report the assigned trycloudflare.com hostname to its controller.T1098.004 · SSH Authorized KeysThe agent installs an SSH public key in /root/.ssh/authorized_keys.T1105 · Ingress Tool TransferLoaders and shell scripts retrieve architecture-specific agent payloads from the reported delivery infrastructure.T1543.002 · Systemd ServiceObserved persistence includes the systemd unit /etc/systemd/system/sys-resource.service.T1546.004 · Unix Shell Configuration ModificationThe agent modifies shell startup configuration, including /etc/profile.d/.sys_alias.sh and an appended shell startup command.
CVE
CVE-2023-48022Ray job submission, CVE-2023-48022, covers remote code execution through the job API in Ray 2.6.3 and 2.8.0.CVE-2026-26220LightLLM PD-mode unsafe deserialization, CVE-2026-26220, covers unauthenticated binary WebSocket data passed to pickle.loads() in versions through 1.1.0.CVE-2026-27944Nginx UI's unauthenticated backup disclosure, CVE-2026-27944, and unauthenticated MCP endpoint, CVE-2026-33032, match the debug build's backup and MCP-chain artifacts.CVE-2026-33032Nginx UI's unauthenticated backup disclosure, CVE-2026-27944, and unauthenticated MCP endpoint, CVE-2026-33032, match the debug build's backup and MCP-chain artifacts.CVE-2026-39987Marimo's unauthenticated terminal WebSocket, CVE-2026-39987, affects versions before 0.23.0 and is in CISA's Known Exploited Vulnerabilities catalog.
People
Malware
14.10-go-titanWe compared the unobfuscated 14.10-go-titan oracle with the supplied packed 33.8-go-titan sample.33.8-go-titanThe sample contacted a new IP address, 209.99.186.235, and retrieved a second-stage agent identifying itself as 33.8-go-titan, which installed several overlapping Linux persistence mechanisms.
Products
ComfyUIProbed Ollama :11434/api/tags and /api/generate, ComfyUI :8188/system_stats and /prompt, and Stable Diffusion WebUI :7860/sdapi/v1/optionsDockerThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andElasticsearchProbed Kubernetes API and kubelet ports, unauthenticated Docker APIs, Elasticsearch, cloud metadata, SSH, databases, caches, and generic MCP locationsFastGPTProbed Ray Dashboard through :8265/api/version; static code also contains LightLLM, Ray, Marimo, Jupyter, and FastGPT deployment pathsJenkinsThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andJupyterProbed Ray Dashboard through :8265/api/version; static code also contains LightLLM, Ray, Marimo, Jupyter, and FastGPT deployment pathsKubernetesThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andLightLLMThe recovered Go binary contains paths for databases, caches, container platforms, application servers, and AI infrastructure, including Ray Dashboard and LightLLM.MarimoProbed Ray Dashboard through :8265/api/version; static code also contains LightLLM, Ray, Marimo, Jupyter, and FastGPT deployment pathsMinIOProbed Nacos, WebLogic, XXL-Job, MinIO, rclone, Spring Gateway, cloud metadata, and many generic MCP locationsMySQLThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andNacosThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andNginx UILightLLM /pd_register, Marimo /terminal/ws, Jupyter, FastGPT, and the two-stage Nginx UI chain were not reached in the bounded replay.OllamaProbed Ollama :11434/api/tags and /api/generate, ComfyUI :8188/system_stats and /prompt, and Stable Diffusion WebUI :7860/sdapi/v1/optionsPostgreSQLThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andRayThe recovered Go binary contains paths for databases, caches, container platforms, application servers, and AI infrastructure, including Ray Dashboard and LightLLM.rcloneProbed Nacos, WebLogic, XXL-Job, MinIO, rclone, Spring Gateway, cloud metadata, and many generic MCP locationsRedisThe agent contains service-specific abuse paths for PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray, LightLLM, and other platforms, including recovered functions named deployRayDashboard andSpring GatewayProbed Nacos, WebLogic, XXL-Job, MinIO, rclone, Spring Gateway, cloud metadata, and many generic MCP locationsStable Diffusion WebUIProbed Ollama :11434/api/tags and /api/generate, ComfyUI :8188/system_stats and /prompt, and Stable Diffusion WebUI :7860/sdapi/v1/optionsWebLogicProbed Nacos, WebLogic, XXL-Job, MinIO, rclone, Spring Gateway, cloud metadata, and many generic MCP locationsXXL-JobProbed Nacos, WebLogic, XXL-Job, MinIO, rclone, Spring Gateway, cloud metadata, and many generic MCP locations
Tools
CloudflaredThe agent also attempted to download cloudflared from GitHub and retained logic to launch a Quick Tunnel to a local port.mitmproxydrops forwarding, captures original packets with tcpdump, transparently redirects TCP through mitmproxy, and sends HTTP, TLS, and WebSocket requests to deterministic aiohttp fixtures.QEMUWe executed a newer x86-64 loader in disposable microVMs, using QEMU user-mode emulation with host-level syscall denial for runtime network connections.tcpdumpThe recorder has no default route or external interface, drops forwarding, captures original packets with tcpdump, transparently redirects TCP through mitmproxy, and sends HTTP, TLS, and WebSocket requests toUPXEighteen of the ELF files were UPX-packed.VirusTotal LivehuntThe same refresh found an enabled four-rule VirusTotal Livehunt ruleset covering loaders, unobfuscated agents, delivery scripts, and MCP autodeployment behavior.YARAHere are some YARA rules for tracking the campaign: one for the newer loader, one for unobfuscated or debug agent builds, and one for delivery scripts.