From Langflow to Monero: Inside CVE-2026-33017 Cryptominer IoCs ==================================================================================================================================================== Indicator Description ==================================================================================================================================================== 71af8bd9b8019b7e5f460ce4c5c14ff7716a2c2faaaf1f274ceaa54cb89723bc lambsys.elf — Go, UPX, 296 KB, xmring-family 33588aa446984d3340cab686d38f2aa85a70eb3f76c459da3eef0304592b99df lambsys.elf — 2024 variant (old sample) ddde47bf00324075c7eeb0b9d0ff0a5d1b95bfc619aca4b5def85263838212f2 procq — customized XMRig miner (extracted from 2026 variant analysis) ==================================================================================================================================================== URLs ==================================================================================================================================================== URI hxxp[://]83[.]142[.]209[.]214/status.php hxxp[://]83[.]142[.]209[.]214/setup_status.php hxxp[://]83[.]142[.]209[.]214:8080/isp.sh hxxp[://]83[.]142[.]209[.]214:8080/lambsys hxxp[://]83[.]142[.]209[.]214:8080/ks.tar hxxp[://]94[.]156[.]64[.]241/r.php Domain ipinfo[.]io (34[.]117[.]59[.]81) User-agent Go-http-client/1.1 SystemMonitor/6.25.0 (Linux x86_64) libuv/1.24.1 gcc/8.3.0 ==================================================================================================================================================== Wallet ==================================================================================================================================================== XMR Wallet 47VVuaLN6h3DiFjCgHMSBE4m4VMHcoowv2ZGQp4M7hLWNfQKJkjbZT31CsLiouPrvtNRRC7dPXJjDNsfS3bvQPKAEzZYJSw ==================================================================================================================================================== File Path ==================================================================================================================================================== /var/tmp/.xlamb/ /var/tmp/.xlamb/lambsys /var/tmp/init_rmount /var/spool/cron/crontabs/user (727 bytes) ./. /. /procq /tmp/.X11-unix/01, /tmp/.X11-unix/11, /tmp/.X11-unix/22, /tmp/.systemd.1, /tmp/.systemd.2, /tmp/.systemd.3 ==================================================================================================================================================== Command ==================================================================================================================================================== userdel akay userdel vfinder sysctl kernel.nmi_watchdog=0 ==================================================================================================================================================== File Modification ==================================================================================================================================================== /etc/rcS.d/K01apparmor ==================================================================================================================================================== Suricata SID ==================================================================================================================================================== 2024897 (ET USER_AGENTS Go HTTP Client) 2025331 (ET INFO ipinfo[.]io in SNI) ==================================================================================================================================================== Ports ==================================================================================================================================================== 3333, 4444, 5555, 6666, 7777, 3347, 14444, 14433, 56415, 9999, 13531, 3380