N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

What it is

Datadog Security Research's July 2026 analysis of the N4D Mesh Controller, a Linux campaign first documented by German Fernandez in June 2026. Datadog ran a newer loader and its packed agent (33.8-go-titan, SHA-256 fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482) in disposable microVMs and an offline replay lab. The agent is UPX-packed and garble-obfuscated Go, and it came from the new controller IP 209.99.186.235. Other delivery hosts are cdnorigin.net and 209.99.186.73.

How it works

Datadog's main contribution is separating what the agent does at runtime from what the older unobfuscated build (14.10-go-titan) merely contains.

• Scanning without tasking. With all egress denied for 120 seconds, the agent made 22,831 connection attempts to 742 IPs on 37 ports (SSH, databases, container APIs, Kubernetes, caches, app servers). It started without controller tasking, and the targets were contiguous ranges. Datadog infers on-host CIDR expansion. It did not recover how the seed ranges are chosen.
• MCP abuse confirmed. Against an inert fixture, the packed agent completed initialize, tools/list, tools/call, picked execute_command, tried id, and sent the result to /api/intel. It wrote /tmp/.n4d_autodeploy_debug.
• Delivery. The loader (module n4d-agent/loader) tries /api/agent/full?arch= and the legacy /api/agent/binary?arch= on ports 80 and 8443. It writes /etc/cron.d/.sys-health on a three-minute schedule. One watchdog script re-downloads to /tmp/.agent every 30 seconds if the file is missing.
• Evasion detail. The agent reads TracerPid from /proc/self/status and exits when traced. Datadog found this when wrapping QEMU in host strace.
• Hidden from command-line monitoring. Controller calls go through an embedded Go HTTP client, so no curl or wget command line appears.

Preconditions / Affected

The entry point is any internet-reachable MCP server without authentication that exposes command execution, file access or database tools. No CVE is needed. Datadog states the agent also targets PostgreSQL, MySQL, Redis, Docker, Kubernetes, Nacos, Jenkins, Ray and LightLLM.

What to do

Hunt for these host artifacts:

• /etc/cron.d/.s, /etc/cron.d/.sys-health, /etc/cron.d/.syscheck
• /etc/profile.d/.sys_alias.sh and /etc/systemd/system/sys-resource.service
• /tmp/.wd, /var/tmp/.wd, /usr/local/bin/.sys-health-monitor, /tmp/.n4d*, /dev/shm/.agent.lock
• Processes named kworker* running from /dev/shm, /tmp or /var/tmp
• Unexpected ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJKH4g/SD6c00i5PzlWWkwXJwIHEac+nlAjg6WeOHUq3 root@ubuntu in /root/.ssh/authorized_keys

Network and MCP telemetry:

• Connections to 209.99.186.73 or 209.99.186.235, and DNS for cdnorigin.net
• HTTP headers X-Mesh-Auth or X-Operator-Key, and paths /api/register, /api/beacon, /api/task/, /api/result/, /api/deployed, /api/pty
• MCP clients named n4d-vps, or n when correlated with other N4D indicators
• MCP server child processes such as curl, wget or shells

The post supplies three YARA rules (loader, unobfuscated agent, delivery script) and a VirusTotal Livehunt behavior rule. The behavior rule matches written files /tmp/.n4d_autodeploy_debug or /tmp/.n4d_nid plus a POST to /api/intel or /api/deployed. Keep file rules and behavior rules in separate Livehunt rulesets to avoid exhausting notification limits.

Response order: isolate, preserve the process tree, binaries and temp files, and only then remove persistence. Rotate cloud, SSH, database and API credentials reachable from the host. For MCP servers, require authentication, bind to loopback or use an authenticated proxy, and remove command-execution tools unless needed. Where needed, use a per-tool allowlist and a short-lived unprivileged sandbox with blocked metadata access and constrained egress.

Caveats

• The YARA agent rule will likely miss packed or garbled builds. Detection counts ranged from 0 to 29 engines across 27 VirusTotal artifacts, so Datadog favors behavioral indicators.
• Quick Tunnel (*.trycloudflare.com) traffic and cloudflared alone are not N4D indicators. Use them only with temporary-path execution or other artifacts.
• The replay did not observe exploitation of Ollama, ComfyUI or Stable Diffusion WebUI. LightLLM, Marimo, Jupyter, FastGPT and the Nginx UI chain were not reached. Ray was probed only for version. Datadog cannot say whether older CVE-specific modules were removed or just gated on tasking, timing or fixture fidelity.
• The exec_verified:false flag is computed on the implant before any controller response. The check logic was not recovered.
• Request totals from the replay are not real scan rates, because the fixture accepted every endpoint.
• Advisories the post links to the static findings: CVE-2026-26220 (LightLLM through 1.1.0), CVE-2023-48022 (Ray), CVE-2026-39987 (Marimo before 0.23.0, in CISA KEV), CVE-2026-27944 and CVE-2026-33032 (Nginx UI).