Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

Over 1,000 internet-exposed ComfyUI instances are being targeted in an active cryptomining and proxy botnet campaign. Threat actors are leveraging a sophisticated scanner and the ComfyUI-Manager to compromise systems.

Technical Breakdown

• Targeting: The campaign specifically targets public-facing instances of ComfyUI, a popular stable diffusion platform.
• TTPs:
  • Attackers deploy a purpose-built Python scanner that continuously sweeps major cloud IP ranges for vulnerable targets.
  • Compromise occurs through the automatic installation of malicious nodes via ComfyUI-Manager. This suggests exploitation of a vulnerability within the manager or leveraging its functionality due to insecure configurations.
  • Compromised systems are subsequently enlisted into a cryptocurrency mining and proxy botnet, consuming resources and potentially being used as a relay for further malicious activities.
• Impact: Resource degradation from illicit cryptomining, potential use of compromised hosts as proxy infrastructure.

Defense

Mitigation: Ensure ComfyUI instances are not unnecessarily exposed to the internet, secure their configurations, and keep ComfyUI and its Manager fully patched. Monitor system resource utilization for anomalous spikes.

Source: https://thehackernews.com/2026/04/over-1000-exposed-comfyui-instances.html