The NadMesh Botnet Targets Unsecured AI Services

This past week was a reminder of how varied today's threat landscape really is. A critical RCE surfaced right in WordPress core, which WordPress put out with forced updates. The SonicWall SMA VPN appliance was being exploited as a zero-day for weeks before disclosure, and the Inc ransomware group used it to reach root.

Alongside that, a new trend showed up: the NadMesh botnet is deliberately hunting exposed AI tools and stealing cloud keys from them. The human layer stays the weak spot, with ACR Stealer spreading through ClickFix, where the victim launches the attack themselves. And the Qilin ransomware group posted around 32 victims in this week alone, which puts the whole roundup into perspective.

wp2shell: code straight into WordPress core

What caught my eye most this week was a critical RCE in WordPress core itself (CVE-2026-63030, nicknamed wp2shell). This is not a plugin or a theme bug, it sits directly in core, so even a clean install with no add-ons at all was exploitable.

Technically it chains two problems in the REST API: a batch-route confusion and a SQL injection in the author__not_in parameter of WP_Query. An unauthenticated attacker can therefore reach code execution with a single anonymous HTTP request. Sites on 6.9 and 7.0 were all in range until WordPress shipped 6.9.5 and 7.0.2 on Friday and switched on forced updates through auto-update. The flaw was reported by Adam Kues at Assetnote, the attack surface management arm of Searchlight Cyber.

Here is why it matters for defense. It is a core bug, so keeping an eye on plugins or themes does not help. WordPress powers an estimated 40 percent of the web, so the blast radius is enormous. Forced updates worked and plenty of sites fixed themselves, but you cannot rely on them one hundred percent. Public PoC exploits are already circulating on GitHub, and there is even a free scan that tells you whether a given site is affected. Attackers have the same tool and the same knowledge.

What to do:

• Confirm you are on 6.9.5 or 7.0.2. Forced updates helped, but not every install has them enabled.
• Check sites with manually managed updates first, they were missed by auto-update.
• Review logs for anonymous REST API requests from before the patch went in.

SonicWall SMA 1000: zero-day all the way to root

The second story is a perimeter classic. The SonicWall SMA 1000, a remote access VPN appliance, was exploited as a zero-day before disclosure, according to Volexity since June 22, 2026. They track the activity as UTA0533.

Shortly after disclosure the Inc ransomware group joined in. It chained the two flaws together and gained root privileges directly on the appliance. That lets an attacker bypass authentication and sit on a device with a view into the entire internal network.

This is exactly the scenario where one exposed box becomes the entry point for company-wide encryption. The discovery came out of an incident response investigation, meaning after someone had actually been breached. The zero-day window was nearly a month, from June 22 to disclosure, with no patch available the whole time. That is precisely why, with perimeter devices, you cannot rely on being up to date alone, you also need to watch appliance behavior and integrity. Root access allows persistent backdoors that survive even a later update.

What to do:

• Update SMA 1000 immediately and verify appliance integrity, root access allows persistent backdoors.
• Patch VPN and remote access as the first line, before internal servers.
• Check appliance accounts and configuration for unknown changes from before the patch.

NadMesh: a botnet hunting your AI tools

This is a topic that will keep growing for this audience. NadMesh is a new botnet written in Go that appeared in early July with a single goal, to find exposed AI services and steal cloud access from them.

Through Shodan it keeps its queue stocked with targets like ComfyUI, Ollama, n8n, Open WebUI, Langflow or Gradio, the image generators, local model runners and workflow builders that teams stand up fast and firewall late. From these it collects cloud keys and Kubernetes tokens.

The operator's own dashboard claims 3,811 unique AWS keys. Each such key can mean access to someone else's cloud, spinning up expensive compute on their account, or data theft. A Kubernetes token can lead to takeover of an entire cluster. In other words, the shadow IT around AI has become a full target, and attackers have realized that experimental AI tools tend to be deployed quickly, without authentication and outside the normal patch cycle. It is a textbook example of how a new wave of technology reopens an old class of bug, the exposed service with no authentication.

What to do:

• Inventory the AI tools in your company, including the ones teams stood up on their own.
• Do not leave any of them on the internet without authentication, ideally behind a VPN or reverse proxy.
• Rotate the cloud keys and Kubernetes tokens these services had access to.

ACR Stealer and ClickFix: an attack the victim launches themselves

Microsoft warned this week about a surge in ACR Stealer attacks on its enterprise customers. This infostealer has been around since 2024, but the interesting part is how it gets in.

The entry point is ClickFix, a social engineering trick where the victim copies a prepared command into the Run box and presses Enter. No exploit, just trust. Through its Defender Experts team, Microsoft laid out two delivery chains that ACR Stealer uses to get in this way.

The stealer then walks out with saved browser passwords, live session tokens, PDFs and documents from Microsoft 365, and files from synced OneDrive and SharePoint folders. A live token is more dangerous than a password, because it bypasses even multifactor authentication. The attacker signs in as the victim without ever facing an MFA prompt. That is why, after a compromise, resetting the password is not enough. Until you invalidate active sessions, the stolen token keeps working.

What to do:

• Teach people that an instruction to paste this into the Run box and press Enter is always an attack, never a technical how-to.
• Consider restricting the Run dialog and script execution for regular users through policy.
• On suspicion, invalidate session tokens, a password change alone does not kill a stolen token.

Qilin: 32 victims in a single week

And to close, a number that gives the week its scale. The Qilin group posted around 32 victims in these seven days alone, all over the world. From the private school The Nueva School to the City Ambulance Service, a church, the food producer Heartland Catfish, through to companies in the US, Europe and Latin America.

This is not one targeted campaign, it is the routine output of a mature ransomware ecosystem that runs like a factory. Qilin operates as ransomware-as-a-service, where the core group supplies the tools and infrastructure and the attacks themselves are run by dozens of affiliates. That is exactly why the victims are so varied by sector and region. There is not one target behind it, but many independent attackers with the same arsenal.

For defenders the lesson is simple. Size and sector no longer decide who becomes a target. What decides is how easily you can be seen from the internet, how fast you patch, and how well you can respond when something happens. Healthcare, schools and manufacturing in this list are no accident, they are sectors that often run on older infrastructure and lack a large security team.

Key takeaways from this week

• Turn on automatic updates everywhere you can. For internet-facing services they shrink the window between patch and exploitation to hours.
• Patch the perimeter, meaning VPN and appliances, first, not last.
• Keep a current inventory of what you have exposed on the internet, including AI tools and test environments.
• Rotate critical tokens and keys regularly and after any suspicion, passwords alone are not enough.
• Session tokens can bypass MFA. Your response plan should invalidate them, not just reset the password.
• Train people on ClickFix. A command in the Run box is an attack, not a how-to.
• Do not assume you are too small or too boring. The ransomware ecosystem now runs broadly and on volume.

What we would do at Cyber Rangers

In practice we tackle these things together. We test your perimeter and exposed services from an attacker's point of view, so you know what is visible from the internet before a botnet or a ransomware group finds it. We run tabletop exercises with your team for scenarios like ClickFix or a VPN compromise, so the first real incident is not the first rehearsal. And we help set up inventory and a patch process so the window between patch and deployment stays as short as possible.