{"id":45191,"date":"2026-04-07T23:14:15","date_gmt":"2026-04-07T15:14:15","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/over-1000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign\/"},"modified":"2026-04-07T23:14:15","modified_gmt":"2026-04-07T15:14:15","slug":"over-1000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/over-1000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign\/","title":{"rendered":"Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign"},"content":{"rendered":"
\"Over<\/a><\/div>\n

An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet.<\/p>\n

“A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets, automatically installing malicious nodes via ComfyUI-Manager<\/a> if no exploitable node is already present,” Censys security researcher Mark Ellzey said<\/a> in a report published Monday.<\/p>\n

The attack activity, at its core, systemically scans for exposed ComfyUI instances and exploits a misconfiguration that allows remote code execution on unauthenticated deployments through custom nodes<\/a>.<\/p>\n

Upon successful exploitation, the compromised hosts are added to a cryptomining operation that mines Monero via XMRig and Conflux via lolMiner, as well as to a Hysteria V2 botnet. Both of them are centrally managed through a Flask-based command-and-control (C2) dashboard.<\/p>\n

Data from the attack surface management platforms shows that there are more than 1,000 publicly-accessible ComfyUI instances<\/a>. While not a huge number, it’s sufficient for a threat actor to run opportunistic campaigns to reap financial gains.<\/p>\n

Censys said it discovered the campaign last month after identifying an open directory on 77.110.96[.]200<\/a>, an IP address associated with a bulletproofing hosting services provider, Aeza Group<\/a>. The directory is said to have contained a previously undocumented set of tools to pull off the attacks.<\/p>\n

This includes two reconnaissance tools to enumerate exposed ComfyUI instances across cloud infrastructure, identify those that have ComfyUI-Manager installed, and shortlist those that are susceptible to the code execution exploit.<\/p>\n

One of the two scanner Python scripts also functions as an exploitation framework that weaponizes ComfyUI’s custom nodes to achieve code execution. This technique, some aspects of which were documented<\/a> by Snyk in December 2024, takes advantage of the fact that some custom nodes accept raw Python code as input and run it directly without requiring any authentication.<\/p>\n

<\/a> <\/p>\n

As a result, an attacker can scan exposed ComfyUI instances for specific custom node families that support arbitrary code execution, effectively turning the service into a channel for delivering attacker-controlled Python payloads. Some of the custom node families that the attack particularly looks for are listed below –<\/p>\n