[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6gZLNakbIyiL8vvXNAzF60fX0eXVp8ViE8drmBjua7U":3},{"article":4,"iocs":42,"watch_terms":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":27,"category":28,"article_tags":31},"b215c0f6-9ab7-4086-a221-a586acc2de29","Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign","over-1-000-exposed-comfyui-instances-targeted-in-cryptomining-botnet-campaign","An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet. \"A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets, automatically installing malicious nodes via ComfyUI-Manager if no exploitable node is already","A coordinated campaign is exploiting internet-exposed ComfyUI instances to recruit them into a cryptocurrency mining and proxy botnet. The attack uses a purpose-built Python scanner that continuously probes cloud IP ranges and automatically installs malicious nodes through ComfyUI-Manager, establishing persistence and command-and-control infrastructure for illicit mining operations.","Active campaign targets 1,000+ exposed ComfyUI instances for cryptomining botnet recruitment.",null,"https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fover-1000-exposed-comfyui-instances.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiNAquH2CuNdKvNbKqIsmTqg2Rpb5SRn8zxBKdQliREzpq_Byd0ye0aD8IFVa1JUj09QnQVJVnAVET30DX0jRBK1LBXJ-16QC_GoiYDH2ibCfoYcttx3McOurmn9e4cSugeNgEQa-oVqR13I9K1h6ktgggudmT3u88I_iN_ksHQvuS2N0u0uGlUNTW_Tv9l\u002Fs1600\u002Fcompfyui.jpg","2026-04-07T12:46:00+00:00","2026-04-07T14:00:11.993207+00:00",8,[18,21,24],{"name":19,"type":20},"ComfyUI","product",{"name":22,"type":23},"Stable Diffusion","technology",{"name":25,"type":26},"ComfyUI cryptomining botnet campaign","campaign","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":11,"name":29,"slug":30},"Malware","malware",[32,37],{"category":33},{"id":34,"icon":11,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":39,"icon":11,"name":40,"slug":41},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[43],{"type":30,"value":44,"context":45},"ComfyUI cryptomining botnet","Purpose-built botnet targeting exposed ComfyUI instances for cryptocurrency mining",[19]]