cyber.hendryadrian.com
Threat Research · thehackernews.com

Langflow CVE-2026-33017 Exploited to Deploy Monero Miner

· Original article ↗

Summary

Trend Micro observed a March 27–April 15, 2026 campaign exploiting Langflow CVE-2026-33017 for unauthenticated RCE and deploying a Monero miner via lambsys, which disables defenses, persists, removes logs and spreads over SSH.

Key points

  • Trend Micro observed the campaign from March 27 to April 15, 2026, exploiting Langflow CVE-2026-33017 for unauthenticated remote code execution.
  • An attacker-supplied Python script launches a shell dropper that downloads and runs lambsys, a Go-based ELF binary.
  • Lambsys terminates competing miners and disables host protections including AppArmor, firewalls and SELinux.
  • The malware establishes cron persistence, alters SSH keys and system files, removes logs, and can spread to SSH-reachable hosts using reused credentials.
  • Lambsys fetches a bespoke XMRig miner and queries ipinfo[.]io for the host’s public IP and location, supporting pool selection and geo-fencing.
  • Researchers say lambsys uses cascades of short-lived shell subprocesses; an artifact from an earlier version was compiled in May 2024.

Article Details

Attack Vectors
  • Unauthenticated remote code execution in exposed Langflow API endpoints via CVE-2026-33017, followed by execution of attacker-supplied Python code.
  • The Python code downloads and launches a shell-script dropper, which fetches and runs the lambsys binary and a custom XMRig miner.
  • The malware spreads to other hosts reachable over SSH using credentials the victim can authenticate with.
Defensive Notes
  • The article describes lambsys disabling host security controls, including AppArmor, Ubuntu's Uncomplicated Firewall, iptables, SELinux, the kernel NMI watchdog, and Alibaba Cloud's Aliyun agent.
  • The malware establishes cron-based persistence, modifies SSH authorized_keys and system files, and removes system logs.
  • The article does not provide specific patch or remediation guidance.

Indicators of compromise

TypeIndicatorContext
IPV483[.]142[.]209[.]214External server used by the malware to beacon and fetch a TAR archive containing the miner.

MITRE ATT&CK

T1021.004 · SSHThe malware propagates to other hosts reachable over SSH using credentials available to the victim.T1053.003 · CronThe malware establishes persistence using cron.T1057 · Process DiscoveryThe dropper checks whether a binary named lambsys is already running on the host.T1059.004 · Unix ShellThe Python code launches a shell-script dropper, and lambsys runs shell commands through short-lived sh -c subprocesses.T1059.006 · PythonAn attacker-supplied Python line is evaluated through the Langflow API endpoint.T1070.002 · Clear Linux or Mac System LogsThe malware removes system logs to cover its tracks.T1098.004 · SSH Authorized KeysThe malware modifies SSH authorized_keys files.T1105 · Ingress Tool TransferThe dropper downloads lambsys, and the malware fetches a TAR archive containing the miner.T1190 · Exploit Public-Facing ApplicationThe campaign exploits CVE-2026-33017 in exposed Langflow endpoints for unauthenticated remote code execution.T1496.001 · Compute HijackingThe campaign deploys a Monero miner to use compromised hosts for cryptocurrency mining.T1562.001 · Disable or Modify ToolsThe binary disables host-level security controls, including AppArmor, SELinux, and Alibaba Cloud's Aliyun agent.T1562.004 · Disable or Modify System FirewallThe binary disables Ubuntu's Uncomplicated Firewall and iptables.

CVE

CVE-2025-3248In June 2025, another critical vulnerability (CVE-2025-3248, CVSS score: 9.8) was abused to distribute the Flodrix botnet malware.CVE-2026-33017Threat actors are exploiting CVE-2026-33017 in Langflow to gain unauthenticated remote code execution and deploy a Monero miner through a multi-stage infection chain.

People

John ZhangTrend Micro researcher quoted on the campaign's infection chain and malware behavior.Simon DuludeTrend Micro researcher quoted on the campaign's infection chain and malware behavior.

Threat Actors

KinsingNamed as a rival cryptojacking group; lambsys terminates miner processes associated with Kinsing. The article does not attribute the Langflow campaign to Kinsing.OutlawNamed as a rival cryptojacking group; lambsys terminates miner processes associated with Outlaw. The article does not attribute the Langflow campaign to Outlaw.RockeNamed as a rival cryptojacking group; lambsys terminates miner processes associated with Rocke. The article does not attribute the Langflow campaign to Rocke.WatchDogNamed as a rival cryptojacking group; lambsys terminates miner processes associated with WatchDog. The article does not attribute the Langflow campaign to WatchDog.

Malware

FlodrixIn June 2025, another critical vulnerability (CVE-2025-3248, CVSS score: 9.8) was abused to distribute the Flodrix botnet malware.lambsysThe campaign uses the lambsys binary to disable security tools, persist via cron and SSH keys, remove traces, and spread to other hosts reachable with reused credentials.XMRig#Langflow

Products

LangflowThreat actors are exploiting CVE-2026-33017 in Langflow to gain unauthenticated remote code execution and deploy a Monero miner through a multi-stage infection chain.

Related Articles