The N4D malware continues to evolve and now uses open MCP servers as a starting point to penetrate infrastructure. Datadog Security Labs has discovered a new version of the malware go-titan, which itself is looking for available tools, launches commands and tries to spread to other systems.
The main goal remains the Model Context Protocol (MCP) servers, through which artificial intelligence-based applications access external tools and data. N4D connects to an Internet-accessible server, requests a list of permitted functions and searches among them for those that allow you to execute commands, work with files and access databases. If the server allows you to run commands without checking the user, attackers do not even need a separate vulnerability.
After penetration, N4D downloads the agent for Linux and starts looking for other available services. In the code, the specialists found funds to work with PostgreSQL, MySQL, Redis, Docker, Kubernetes, Jenkins, Nacos, Ray and LightLM. The new version also checks Ollama, ComfyUI and Stable Diffusion WebUI services. At the same time, Datadog confirmed that the program only scanned the last three services, but could not successfully operate them.
The scale of automation was manifested when the 33.8-go-titan sample was launched in an isolated environment. In 120 seconds, the program tried to connect 22,831 times with 742 IP addresses via 37 ports. Scan the machine started without the commands of the control server, so the infected node is able to independently search for new targets in the neighboring ranges of addresses.
The current version also demonstrated how to fully interact with the MCP. The agent connected to the test server, received a list of tools, selected the function execute_command, tried to execute the command id, and then sent the result to the control server. Datadog believes that this behavior directly confirms: MCP capabilities are automatically abused.
To gain a foothold in Linux, N4D creates hidden cron tasks, changes the files from which the command shell is started, adds a systemd service and its own SSH key. Processes can be disguised as Linux kernel system processes. To further communicate with the control server, the malware is able to run Cloudflare time tunnels and transfer the address received.
Experts recommend closing public access to MCP servers without authentication, removing unnecessary functions that allow you to run commands and contact files indefinitely, and perform the necessary commands in an isolated environment with minimal rights. If N4D is detected, the infected node should be isolated and cloud credentials, SSH keys, database passwords, and software interface keys available to the infected process should be replaced.
The main goal remains the Model Context Protocol (MCP) servers, through which artificial intelligence-based applications access external tools and data. N4D connects to an Internet-accessible server, requests a list of permitted functions and searches among them for those that allow you to execute commands, work with files and access databases. If the server allows you to run commands without checking the user, attackers do not even need a separate vulnerability.
After penetration, N4D downloads the agent for Linux and starts looking for other available services. In the code, the specialists found funds to work with PostgreSQL, MySQL, Redis, Docker, Kubernetes, Jenkins, Nacos, Ray and LightLM. The new version also checks Ollama, ComfyUI and Stable Diffusion WebUI services. At the same time, Datadog confirmed that the program only scanned the last three services, but could not successfully operate them.
The scale of automation was manifested when the 33.8-go-titan sample was launched in an isolated environment. In 120 seconds, the program tried to connect 22,831 times with 742 IP addresses via 37 ports. Scan the machine started without the commands of the control server, so the infected node is able to independently search for new targets in the neighboring ranges of addresses.
The current version also demonstrated how to fully interact with the MCP. The agent connected to the test server, received a list of tools, selected the function execute_command, tried to execute the command id, and then sent the result to the control server. Datadog believes that this behavior directly confirms: MCP capabilities are automatically abused.
To gain a foothold in Linux, N4D creates hidden cron tasks, changes the files from which the command shell is started, adds a systemd service and its own SSH key. Processes can be disguised as Linux kernel system processes. To further communicate with the control server, the malware is able to run Cloudflare time tunnels and transfer the address received.
Experts recommend closing public access to MCP servers without authentication, removing unnecessary functions that allow you to run commands and contact files indefinitely, and perform the necessary commands in an isolated environment with minimal rights. If N4D is detected, the infected node should be isolated and cloud credentials, SSH keys, database passwords, and software interface keys available to the infected process should be replaced.
