A cryptocurrency-mining campaign is exploiting an unauthenticated remote code execution flaw in Langflow to deploy a customized Go-based miner. The attack chain uses a bash-script dropper to establish persistence and move laterally through reused SSH keys. The malware also disables host-level security measures and terminates competing mining processes to maximize available system resources.
Researchers monitored the campaign over a 19-day window and identified a consistent exploitation pattern involving a hardcoded flow_id and rotating user-agent strings. Their investigation revealed a multi-stage intrusion built around a Go-based binary named lambsys.elf , which handled defense evasion, log removal, and watchdog-backed persistence. Based on user-deletion behavior and lateral movement techniques, the toolchain is believed to lineage with the KORKERDS or MALXMR family.
Organizations should upgrade Langflow to version 1.9.0 or newer to remediate the remote code execution issue. It is also strongly recommended to block public internet exposure of Langflow instances and avoid running the service with excessive privileges. Additional controls should ensure that public flows cannot accept unauthenticated input capable of triggering code execution.
If this activity is detected, security teams should treat it as both a cryptomining compromise and a possible SSH key exposure incident. Immediate steps should include rotating all potentially exposed SSH keys and reviewing connected hosts for signs of lateral movement. Teams should also audit system logs for unauthorized account creation or deletion and inspect systems for any unapproved security configuration changes.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The attacker identifies a vulnerable Langflow instance running on a Linux server. Using the CVE-2026-33017 vulnerability, the attacker injects a malicious Python payload into a request. The goal is to bypass perimeter defenses and deploy a Monero cryptominer. The payload uses Python’s os.system to invoke /bin/sh , which then downloads a shell script ( isp.sh ) from the attacker’s infrastructure ( 83.142.209.214:8080 ) and pipes it directly into a shell for immediate execution.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
