n4d/NadMesh: C2-Coordinated Propagation System Weaponizes MCP
209.99.186.235AS402253 - SKN Subnet & Telecom Ltd · Zurich, Switzerland- Observation window
- 2026-07-09 19:46 - 2026-07-10 04:51 UTC
- Author
- Boredchilada
- Status
- Confidence: High (binary captured from controlled Docker sensor, dynamic analysis completed, MCP wire protocol independently captured on controlled infrastructure)
- Published
- 2026-07-18
- domaincdnorigin[.]netUpdate distribution domain (on IPFire DBL, URLhaus)
- ip101[.]200[.]127[.]158Scan node (Alibaba, China)
- ip106[.]75[.]86[.]199Scan node, Docker-capable (China Telecom, China)
- ip110[.]42[.]215[.]53Scan node (Tencent, China)
- ip124[.]220[.]155[.]117Scan node, Docker-capable (Tencent, China)
- ip141[.]11[.]157[.]12Scan node (CSNE, Thailand)
- ip153[.]125[.]146[.]142Scan node, Docker-capable (SAKURA Internet, Japan)
- ip159[.]223[.]211[.]139Scan node (DigitalOcean, Netherlands)
- ip167[.]148[.]201[.]106Scan node, same /24 cluster (US)
- ip167[.]148[.]201[.]115Scan node, same /24 cluster (US)
- ip167[.]148[.]201[.]86Scan node (US)
- ip176[.]32[.]193[.]16Scan node, Docker-capable (Ucom, Armenia)
- ip183[.]91[.]9[.]63Scan node (CMC Telecom, Vietnam)
- ip209[.]54[.]105[.]166Scan node (HostPapa, US)
- ip209[.]99[.]186[.]235C2 primary, Mesh Control panel (SKN Subnet & Telecom, Switzerland)
- ip209[.]99[.]186[.]73C2 secondary, same /24 (SKN Subnet & Telecom, Switzerland)
- ip45[.]144[.]164[.]52Scan node, initial observation (Siamdata, Thailand)
- ip45[.]156[.]129[.]65Scan node (NSEC, Portugal)
- ip45[.]32[.]95[.]6Scan node (Vultr, US)
- ip46[.]101[.]114[.]225Scan node (DigitalOcean, Germany)
- ip46[.]161[.]50[.]108Scan node, Docker-capable (PIN ltd., Russia)
- ip47[.]95[.]178[.]229Scan node, Docker-capable (Alibaba, China)
- ip5[.]101[.]64[.]6Scan node, Docker-capable (PIN ltd., Russia)
- ip71[.]241[.]212[.]142Scan node (US)
- ip8[.]138[.]17[.]213Scan node (Alibaba, China)
- sha2564676bcd66adef10310c42e6c812e9dfe5a6a2de497cbec0cb95b5d1b8b3f66c9n4d worm, Jul 17 build (packed)
- sha2569b529a1415b43936c769ef02e4272c6df3ed8135d7405420f0c5f1542489d0f7n4d loader, Jul 8 build
- sha256cc690efb85abd5d9d72a74387559037d6144129abbaaff018d9a46ff73998e19n4d loader, Jul 10 build
- sha256fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482n4d worm, Jul 10 build (packed)
- ssdeep
- ssdeep
- ssh_keyAAAAC3NzaC1lZDI1NTE5AAAAIJKH4g/SD6c00i5PzlWWkwXJwIHEac+nlAjg6WeOHUq3Persistence SSH key (root@ubuntu)
- tlsh
- tlsh
- urlhxxp://209[.]99[.]186[.]235:80/api/agent/full?arch=amd64Agent binary download
- urlhxxp://209[.]99[.]186[.]235:9090/api/agent/binary?arch=amd64Updater fallback
- urlhxxp://cdnorigin[.]net/api/agent/binary?arch=amd64Updater primary download
- urlhxxp://cdnorigin[.]net/api/agent/loader?k=n4d-2ff16c75b1d2Loader download
A centrally managed propagation loop
n4d, also called NadMesh in later public reporting, is a Go-based propagation system that uses exposed Model Context Protocol servers as an entry point. Scan nodes receive /24 assignments from a controller at 209.99.186.235, probe 19 ports, run the MCP initialize and tools/list sequence, then report servers that expose command, code, or database tools without authentication. The C2 deploys the agent to suitable targets. Each new host enrolls and starts scanning its own assignments.
This is not an MCP protocol vulnerability. The exposed servers are behaving as configured, but many were designed for a trusted local AI client and have no access control when placed on the public internet.
Two captures linked the operation
A scan node at 45.144.164.52 sent six matching MCP probe bursts to controlled fleet sensors over roughly six hours. A separate Docker sensor then captured 209.99.186.235 creating containers, downloading a loader and the main agent, planting an SSH key, and installing persistence.
The two streams shared the same MCP fingerprint: clientInfo.name set to "n" with protocol version 2024-11-05. The SSH key used during Docker delivery also matched the key embedded in the agent's persistence kit. Those artifacts link the scanning and deployment activity to the same operation.
Fleet telemetry grouped 22 scanning IPs and two C2 addresses across 11 countries. The controller's unauthenticated health endpoint claimed 30,394 enrolled nodes. That figure is self-reported and was not independently verified.
What survives on a compromised host
Both captured builds installed the same 18-file persistence kit. High-signal paths include /var/tmp/.a, /usr/local/lib/.a, and the triplicated node ID file /dev/shm/.n4d_nid. A watchdog checks the process every 25 seconds, a two-minute cron job pulls updates from cdnorigin.net, shell login hooks restart the binary, and an Ed25519 key is appended to authorized_keys.
The agent also searches for Ollama and Anthropic tokens, AWS credentials, .env files, Jenkins secrets, Docker and Kubernetes access, and cloud instance metadata. Its MCP dispatch table names seven exploitable tools, including execute_command, database-query-executor, and deploy-code-to-production.
Checks to run now
Keep MCP servers off the public internet unless authentication and authorization are enforced. Search ingress logs for the "n" client name, repeated MCP JSON-RPC POSTs across unusual ports, and Go-http-client/1.1. Block or investigate connections to 209.99.186.235 and cdnorigin.net.
On Linux hosts, check /dev/shm, /tmp, /var/tmp, /usr/local/lib, cron entries, /etc/profile.d, shell startup files, and authorized_keys for the indicators in the full report. The report includes Suricata rules, YARA signatures validated against both captured builds, host hunt commands, and the complete IOC set.