A current operation has been detected targeting publicly accessible ComfyUI instances, a well-known platform for stable diffusion, to incorporate them into a botnet for cryptocurrency mining and use as proxies.

“A specifically designed Python scanner is constantly searching cloud IP ranges for vulnerable targets, automatically installing malicious software through ComfyUI-Manager if a readily exploitable node isn’t already there,” said Mark Ellzey, a Censys security researcher, in a report released on Monday.

Essentially, the attack systematically scans for exposed ComfyUI setups and takes advantage of a configuration issue that enables remote code to be executed on deployments without authentication using custom nodes.

Once a system is breached, the compromised machines are added to a mining operation that mines Monero using XMRig and Conflux with lolMiner, as well as a Hysteria V2 botnet. Both are centrally controlled by a Flask-based command-and-control (C2) panel.

Data from attack surface management platforms indicates that there are over 1,000 ComfyUI instances accessible to the public. While not a significant number, it’s adequate for an attacker to launch opportunistic campaigns for financial benefit.

Censys reported discovering the campaign last month after finding an open directory at 77.110.96[.]200, an IP address linked to Aeza Group, a provider of bulletproof hosting services. The directory reportedly contained a previously unknown collection of tools used to execute the attacks.

This collection includes two reconnaissance tools designed to identify exposed ComfyUI instances across cloud infrastructure, determine which have ComfyUI-Manager installed, and identify those vulnerable to the code execution exploit.

One of the Python scanning scripts doubles as an exploitation tool, leveraging ComfyUI’s custom nodes to execute code. Snyk documented some aspects of this technique in December 2024, which involves certain custom nodes accepting raw Python code as input and executing it without any authentication.

Consequently, an attacker can scan exposed ComfyUI instances for specific custom node families that allow arbitrary code execution, turning the service into a channel for delivering Python code controlled by the attacker. Below are examples of node families the attack specifically searches for:

• Vova75Rus/ComfyUI-Shell-Executor
• filliptm/ComfyUI_Fill-Nodes
• seanlynch/srl-nodes
• ruiqutech/ComfyUI-RuiquNodes

“If none of the designated nodes are found, the scanner checks if ComfyUI-Manager is installed,” said Censys. “If present, it installs a vulnerable node package and retries the exploit.”

Notably, “ComfyUI-Shell-Executor” is a malicious package created by the attacker to retrieve a follow-up shell script (“ghost.sh”) from the mentioned IP address. After establishing code execution, the scanner eliminates evidence of the exploit by clearing the ComfyUI prompt history.

A more recent version of the scanner includes persistence methods that cause the shell script to be downloaded every six hours and the exploit to be re-run each time ComfyUI starts.

The shell script disables shell history, terminates competing miners, starts the mining operation, and utilizes the LD_PRELOAD to hide a watchdog process that ensures the mining process is restarted should it be killed.

Additionally, the miner program is replicated to multiple locations to ensure it can be launched from a different location if the primary directory is wiped. To further ensure persistence, the malware uses the “chattr +i” command to lock the miner binaries, preventing them from being deleted, renamed, or modified, even by the root user.

“There is also specific code targeting a competitor, ‘Hisana’ (mentioned throughout the code), which appears to be another mining botnet,” Censys explained. “Instead of simply killing it, ghost.sh overwrites Hisana’s configuration to redirect its mining output to the attacker’s wallet address, then occupies Hisana’s C2 port (10808) with a dummy Python listener to prevent Hisana from restarting.”

The infected devices are controlled via a Flask-based C2 panel, enabling the operator to send instructions or deploy more payloads, including a shell script to install Hysteria V2, likely to sell access to the infected nodes as proxies.

Further investigation of the attacker’s shell command history uncovered an attempt to log in as root to the IP address 120.241.40[.]237 via SSH, an IP linked to an ongoing worm campaign targeting exposed Redis database servers.

“Much of the tooling found in this repository seems hastily put together, and the overall tactics and techniques may seem unsophisticated at first,” Censys said. “Specifically, the operator identifies exposed ComfyUI instances using custom nodes, determines which nodes have unsafe functionality, and exploits them to achieve remote code execution.”

“The infrastructure the operator accesses further suggests this activity is part of a larger campaign focused on finding and exploiting exposed services, followed by deploying custom tools for persistence, scanning, or monetization.”

This discovery coincides with the increase multiple botnet campaigns in recent weeks:

• Exploitation of command injection vulnerabilities in n8n (CVE-2025-68613) and Tenda AC1206 routers (CVE-2025-7544) to integrate them into a Mirai-based botnet known as Zerobot.
• Exploitation of vulnerabilities in Apache ActiveMQ (CVE-2023-46604), Metabase (CVE-2023-38646), and React Server Components (CVE-2025-55182 aka React2Shell) to deliver Kinsing, a persistent malware used for both cryptocurrency mining and launching Distributed Denial of Service (DDoS) attacks.
• Exploitation of a suspected zero-day vulnerability in fnOS Network Attached Storage (NAS) to target publicly accessible systems and infect them with a DDoS-capable malware named Netdragon. “NetDragon creates an HTTP backdoor interface on the compromised devices, allowing attackers to control and remotely access infected systems,” QiAnXin XLab reported. “It manipulates the ‘hosts’ file to take over the official Feiniu NAS system update domains, preventing devices from receiving updates and security patches.”
• Broadening RondoDox‘s list of exploits to 174 different vulnerabilities while shifting attack methods from a “shotgun approach” to targeting more recent flaws that are more likely to lead to infections.
• Exploitation of known security vulnerabilities to deploy a new variant of Condi, a Linux malware that compromises Linux devices and turns them into bots capable of launching DDoS attacks. The binary references the string “QTXBOT,” possibly representing the name of the variant or the internal project name.
• Brute-force attacks against SSH servers to initiate XMRig mining and illicitly generate funds via cryptocurrency as part of a cryptojacking operation referred to as Monaco. Weak SSH passwords have also been used as pathways to deploy malware that establishes persistence, terminates competing miners, connects to an external server, and performs a ZMap scan to spread the malware in a worm-like manner to other vulnerable hosts.

“Botnet activity has significantly increased in the last year, as Spauhaus noted a 26% increase during January – June 2025 and a 24% increase during July – December 2025,” Pulsedive reported.

“This increase is linked to the appearance of more nodes and bots in the United States. The increase also arises from the availability of source code for botnets, such as Mirai. Variants and offshoots of Mirai are credited with launching some of the largest DDoS attacks in terms of volume.”