Langflow CVE-2026-33017 isp.sh Shell Dropper Execution via curl/wget

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•2

Detects download, execution, and network activity associated with the 'isp.sh' dropper script. This includes the use of common utilities like curl or wget to fetch the script from a specific C2 IP address (83.142.209.214), piping the script directly to a shell, and signs of secondary payload execution such as 'lambsys'.