Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

This article covers an active cryptomining botnet campaign targeting over 1,000 internet-exposed ComfyUI instances via a remote code execution exploit.

• •A Python scanner continuously sweeps cloud IP ranges for exposed ComfyUI deployments and exploits misconfigured custom nodes that accept unauthenticated raw Python code execution
• •Compromised hosts mine Monero via XMRig and Conflux via lolMiner, and are enrolled in a Hysteria V2 proxy botnet, all managed via a Flask-based C2 dashboard
• •The malware uses multiple persistence mechanisms: LD_PRELOAD hooks, chattr +i to lock binaries, fallback install locations, and re-execution every ComfyUI startup
• •If no vulnerable custom node is present, the scanner installs a malicious package (ComfyUI-Shell-Executor) via ComfyUI-Manager to achieve code execution