Cryptomining Botnet Exploits Over 1,000 Exposed ComfyUI Instances

Overview of the ComfyUI Cryptomining Campaign

An ongoing, active campaign is targeting over 1,000 internet-exposed instances of ComfyUI, a popular platform used for stable diffusion model workflows. The objective of this campaign is to enlist these compromised systems into a cryptocurrency mining and proxy botnet. This represents a significant risk for organizations and individuals operating public-facing ComfyUI deployments, as it can lead to unauthorized resource consumption, potential data exposure, and serve as a launchpad for further malicious activities, as reported by The Hacker News.

ComfyUI’s popularity, particularly in cloud environments for AI and machine learning tasks, makes exposed instances attractive targets for adversaries seeking computational resources for illicit gains. The discovery of over 1,000 vulnerable instances highlights a critical need for immediate security posture review among ComfyUI users.

Technical Analysis: Attack Vector and Modus Operandi

The threat actors behind this campaign employ a sophisticated automated reconnaissance and deployment mechanism. A purpose-built Python scanner continuously sweeps major cloud IP ranges to identify potential targets. This scanner specifically looks for publicly accessible ComfyUI instances. Once an exposed instance is identified, the attackers leverage the ComfyUI-Manager component to facilitate the installation of malicious nodes.

ComfyUI-Manager is a common plugin that extends ComfyUI’s functionality, often used for managing custom nodes and models. The source indicates that attackers are using ComfyUI-Manager to install malicious components onto the exposed instances. This implies that either the instances are configured with an open management interface, or the initial compromise allows for the abuse of this legitimate functionality for payload deployment. If no ‘exploitable node’ is already present, the attackers proceed to install their malicious nodes, transforming the victim’s system into part of their cryptomining and proxy botnet.

The primary immediate impact of such a compromise is the theft of computational resources for cryptocurrency mining. This can lead to increased infrastructure costs, degraded system performance, and potential hardware wear. Beyond cryptomining, the establishment of a proxy botnet introduces additional risks. Compromised machines can be used to relay malicious traffic, obfuscate the true origin of attacks, or conduct DDoS attacks against other targets, further implicating the owners of the compromised ComfyUI instances.

Detecting ComfyUI Botnet Compromise Indicators

Security teams should be vigilant for specific indicators of compromise. While the source does not detail specific IoCs, general signs of cryptomining activity include consistently high CPU or GPU utilization, unexplained network traffic spikes (especially to cryptocurrency pools), and the presence of new, unauthorized processes or files related to mining software. Unusual outbound connections, particularly to unknown IP addresses or domains, could also signal proxy botnet activity.

Monitoring system logs for unauthorized changes to ComfyUI configurations or newly installed nodes via ComfyUI-Manager is also essential. Unexpected file modifications within the ComfyUI installation directory or the presence of new executables should trigger an immediate investigation.

Actionable Recommendations for Securing ComfyUI Deployments from Cryptomining

Defenders must prioritize immediate actions to mitigate this threat. The core issue remains the public exposure of ComfyUI instances, particularly those with accessible ComfyUI-Manager interfaces. Organizations should implement a layered security approach.

• Restrict Network Access: The most critical step is to limit network exposure. ComfyUI instances should not be directly accessible from the public internet unless absolutely necessary. Implement strict firewall rules to restrict access to trusted IP ranges only. If remote access is required, consider using VPNs or secure shell (SSH) tunneling.
• Review Cloud Security Groups and ACLs: For cloud-deployed ComfyUI instances, meticulously review security group configurations, network ACLs, and load balancer settings to ensure that only authorized traffic can reach the application.
• Implement Authentication and Authorization: Ensure all ComfyUI interfaces, particularly ComfyUI-Manager, are protected by strong authentication mechanisms. Implement robust access controls to prevent unauthorized configuration changes or node installations.
• Monitor Resource Utilization: Continuously monitor CPU, GPU, and network bandwidth usage for anomalies. Sudden, sustained spikes in resource consumption often indicate cryptomining activity. Integrate monitoring with your SIEM or EDR solutions.
• Regularly Update and Patch: While no specific CVE is identified for ComfyUI-Manager in this context, maintaining all software, including ComfyUI and its plugins, in an up-to-date state is a fundamental security practice. Apply patches promptly to address known vulnerabilities.
• Network Segmentation: Isolate ComfyUI deployments within a segmented network to limit potential lateral movement if a compromise occurs. This can prevent an attacker from easily moving from the ComfyUI instance to other critical systems.
• Egress Filtering: Implement egress filtering on network firewalls to block outbound connections to known cryptocurrency mining pools or suspicious C2 (command and control) servers, which can help detect and disrupt active botnet operations.