# N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it

DevFeed: [N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it](<https://devfeed.tech/articles/n4d-mesh-controller-new-infrastructure-a-upx-packed-agent-labeled-go-titan-and-how-to-hunt-for-it-8293.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/n4d-mesh-controller-go-titan-new-infrastructure-hunting/>)

Author: Zander Mackie

Published: 2026-08-20T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [Persistence](<https://devfeed.tech/topics/persistence.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [AI Infrastructure](<https://devfeed.tech/topics/ai-infrastructure.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>)

Tags: [ai-infrastructure](<https://devfeed.tech/tags/ai-infrastructure.md>), [c2](<https://devfeed.tech/tags/c2.md>), [credential-theft](<https://devfeed.tech/tags/credential-theft.md>), [go](<https://devfeed.tech/tags/go.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [persistence](<https://devfeed.tech/tags/persistence.md>)

## AI overview

Datadog Security Research analyzes an active N4D Mesh Controller malware campaign targeting exposed MCP servers and other internet-facing services. The article documents a newer UPX-packed go-titan loader-to-agent chain, rotated infrastructure, Linux persistence mechanisms, automated MCP tool discovery and command execution, and broad scanning across databases, container platforms, application servers, and AI infrastructure.

## Source excerpt

Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.