ComfyUI exposure abuse for mining and proxying

Active **ComfyUI** deployments are being scanned and turned into a **cryptomining and proxy botnet**. The operator uses a purpose-built Python scanner to sweep major cloud IP ranges, checks for **ComfyUI-Manager**, and installs malicious nodes when needed to reach exploitable custom nodes. That access can produce unauthenticated remote code execution, after which compromised hosts mine **Monero** with **XMRig** and **Conflux** with **lolMiner** and join a **Hysteria V2** proxy network. Persistence steps include **ghost.sh**, repeated script execution on startup, prompt-history wiping, LD_PRELOAD hiding, and **chattr +i** locking. More than **1,000 publicly accessible instances** are in scope, so the campaign is broad enough to sustain ongoing monetization. Available evidence does not show how many hosts were fully compromised or whether every exposed instance in scope was reached.