--- title: "From Langflow to Monero: Inside CVE-2026-33017 Cryptominer" url: https://daily.dev/posts/from-langflow-to-monero-inside-cve-2026-33017-cryptominer-yaxregtae source_url: https://www.trendmicro.com/en_us/research/26/f/from-langflow-to-monero-inside-cve-2026-33017-cryptominer.html type: article source: "Trend Micro" published: 2026-06-23T12:17:31.763Z updated: 2026-06-23T12:17:58.662Z tags: ["security", "golang"] reading_time: 33 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From Langflow to Monero: Inside CVE-2026-33017 Cryptominer **[Trend Micro](https://daily.dev/sources/trendmicro)** · 33 min read · 0 upvotes · 0 comments ## Summary A detailed threat analysis of a cryptocurrency-mining campaign exploiting CVE-2026-33017, an unauthenticated RCE vulnerability in Langflow, an AI workflow framework. Attackers send a single Python eval via an unauthenticated API endpoint to download and execute a dropper (isp.sh), which deploys a UPX-packed Go binary (lambsys.elf). The binary kills rival miners, disables AppArmor, SELinux, UFW, iptables, and Alibaba Cloud's security agent, plants dual cron/bash watchdog persistence, and launches a customized XMRig miner (procq) mining Monero. The malware also spreads laterally via SSH key reuse. The toolchain traces lineage to the 2019 KORKERDS/MALXMR family but has been actively maintained with OPSEC improvements. Organizations should update Langflow to 1.9.0+, restrict public access, and treat any compromise as a potential SSH-key-exposure incident. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Langflow RCE Actively Exploited to Deploy Cryptominers on AI Infrastructure](https://daily.dev/posts/langflow-rce-actively-exploited-to-deploy-cryptominers-on-ai-infrastructure-etl1ohlb0) · Orca Security Blog · 0 upvotes · 0 comments - [Langflow RCE under active attack months after a patch was shipped](https://daily.dev/posts/langflow-rce-under-active-attack-months-after-a-patch-was-shipped-jzjannqnb) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/from-langflow-to-monero-inside-cve-2026-33017-cryptominer-yaxregtae)