A detailed threat analysis of a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated RCE vulnerability in Langflow, an AI workflow framework. Attackers send a single Python eval via an unauthenticated API endpoint to download and execute a dropper (isp.sh), which deploys a UPX-packed Go binary (lambsys.elf). The binary kills rival miners, disables AppArmor, SELinux, UFW, iptables, and Alibaba Cloud's security agent, plants dual cron/bash watchdog persistence, and launches a customized XMRig miner (procq) mining Monero. The malware also spreads laterally via SSH key reuse. The toolchain traces lineage to the 2019 KORKERDS/MALXMR family but has been actively maintained with OPSEC improvements. Organizations should update Langflow to 1.9.0+, restrict public access, and treat any compromise as a potential SSH-key-exposure incident.
