CVE

CVE-2026-27944

View on NVD ↗

Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

Exploitation IoCs 24

Domain *[.]trycloudflare[.]com
Domain cdnorigin[.]net
Filename /dev/shm/.n4d
Filename /etc/cron.d/.sys-health
Filename /etc/profile.d/.sys_alias.sh
Filename /etc/systemd/system/sys-resource.service
Filename /tmp/.n4d_autodeploy_debug
Filename /tmp/.sys-health-monitor.tmp
Filename /var/tmp/.a
Filename /var/tmp/.wd
GitHub Repo n4d-agent/loader
SHA-256 0d5f67b6d35e609e1d5eac0afd981147ea8df7da2f192ae59ac0bab7e48cc1de
SHA-256 3435cc9d4a255bfb4cfb09f2390c29b888f70a43345cfaaecf46c55bc89b814d
SHA-256 749e8835bb407336742f3fff5f81ba5eb476a42dfc0246f1107d4f28f1bea708
SHA-256 77fe750d6b94b32e80e25aecb2ae7c435f0b45cfca25969dbee4dc22967b1302
SHA-256 79e44b8523ee1e371436ca36e91d4d6f932beb371e7d77de756ffdd8f825e763
SHA-256 94ae566e27b176698958b4b9c216a0a2b0ac7ce11d7d81417c8add081fd3cc9c
SHA-256 c422621ef824b627d74906f8d75ed8f990f4d6c708a0d263f219f9d9dd435174
SHA-256 d4483b7a943faeec2ce6690e508ee3a30c7fc1e546887658921c132f179b8e78
SHA-256 e09ac5e8c23a768a2370cff29aca64be0d6e210e1176ee526bb7e47f537509ae
SHA-256 fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482
IP 209[.]99[.]186[.]235
IP 209[.]99[.]186[.]73
Registry User n4d-2ff16c75b1d2

MITRE ATT&CK TTPs 1

T1071.001
Web Protocols
Command And Control

Source Articles

N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
The N4D Mesh Controller is an active Linux malware campaign that exploits exposed Model Context Protocol (MCP) servers to enable credential theft, lateral movement, persistence, and command and control. The campaign uses a UPX-packed Go-based agent named 'go-titan' that communicates with controllers via custom headers and supports secondary C2 through Cloudflare Quick Tunnels. The agent targets AI and infrastructure services including Ray Dashboard, LightLLM, PostgreSQL, Redis, Kubernetes, and Jenkins, using automated scanning and exploitation techniques.
datadog-security-labs Aug 20, 2026