PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
Summary: Lumen Black Lotus Labs reported a financially motivated campaign it calls Canto Incognito that targets exposed AI and LLM infrastructure such as LiteLLM and Gotenberg, along with Gitea and Ivanti Sentry appliances, to install XMRig and Iron cryptocurrency miners and connect victims to the Russian mining service Kryptex. The malware, codenamed PoeLLM, hides its command-and-control address in an AI-written poem hosted in a GitHub repository whose first commit was April 13, 2026, and more than 3,400 victim servers have been identified since April 2026, concentrated in the U.S. and Western Europe.
Bottom line: At its mid-June peak the campaign involved almost 2,200 affected servers with nearly 800 active per day, and compromised hosts are reused as scanners and exploit servers to find more victims - so each exposed LLM instance you leave internet-facing is potential compute and a launch point against the next one.
Read the original at The Hacker News ↗
- Topics
- AI Security
- Related
- SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 8 Cyber Risks · Nov 15, 2026Pentagon Renames CDAO ‘Super Intelligence Office’ Cyber Risks · Nov 15, 2026186 Fake AI Domains Redirect Users to Click Fix Lures, Browser Malware, and Search Hijackers Cyber Risks · Nov 12, 2026