CVE-2026-33017 Cryptominer Campaign Targeting Langflow Instances

A cryptocurrency-mining campaign has been observed exploiting CVE-2026-33017, an unauthenticated remote code execution (RCE) vulnerability in Langflow, a popular Python framework for AI workflows. The attackers target exposed AI application endpoints to deliver a multi-stage attack chain involving a bash dropper (isp.sh) and a Go-based binary (lambsys.elf). This campaign marks a shift where commodity cryptominer operators are now scanning AI infrastructure as a primary delivery vector.

The malware exhibits highly aggressive tradecraft, including disabling multiple security controls (AppArmor, SELinux, UFW, Aliyun Agent), terminating dozens of rival mining processes, and establishing persistent watchdogs via cron and bash loops. Crucially, the campaign includes an SSH-worm component that spreads the infection by enumerating local keys and agent sockets, potentially turning a single exposed AI service into a gateway for broader network compromise.

This activity demonstrates iterative development from a toolset lineage potentially linked to the KORKERDS and Autom campaigns. Organizations utilizing Langflow must prioritize patching to version 1.9.0 or later and ensure that AI development tools are not exposed to the public internet without robust authentication.