{"id":3429,"date":"2026-10-07T21:05:12","date_gmt":"2026-10-07T21:05:12","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3429"},"modified":"2026-10-07T21:05:12","modified_gmt":"2026-10-07T21:05:12","slug":"poellm-malware-infects-3400-servers-to-expand-crypto-mining-botnet","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3429","title":{"rendered":"PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 07, 2026<\/span><\/span>Botnet \/ Cryptojacking<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet.<\/p>\n

The financially motivated campaign, dubbed Canto Incognito<\/strong>, has been found to install cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.<\/p>\n

\u00abCompromised hosts are reused to expand the botnet,\u00bb Lumen Black Lotus Labs said<\/a> in a report shared with The Hacker News. \u00abInfected servers are turned into scanners and exploit servers, allowing the actor to find and compromise additional vulnerable systems.\u00bb<\/p>\n

The malware distributed as part of the campaign has been codenamed PoeLLM<\/strong> owing to what has been described as a \u00abcreative\u00bb technique that hides the command-and-control (C2) address within a poem the threat actors wrote and hosted in a GitHub repository (\u00abgithub[.]com\/ejejejdfbbebe\u00bb). The first commit to the repository was on April 13, 2026.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abEach time they set up a new C2, they change a few words in the poem, and the malware derives the address from the key associated with those words,\u00bb Ryan English, information security engineer at Lumen Technologies, told The Hacker News.<\/p>\n

The attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.<\/p>\n\n\n\n\n
\"\"<\/a><\/td>\n<\/tr>\n
C2 Extraction Logic<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The targeting of these LLM instances is no coincidence as the intention is to abuse their compute power for illicit cryptocurrency mining. Evidence indicates that the malware has been active since April 2026, with more than 3400 victim servers identified so far. The infections are concentrated in the U.S. and Western Europe.<\/p>\n

\"\"<\/a><\/div>\n

\u00abAt the peak of operations in mid-June, the campaign involved almost 2,200 affected servers, with nearly 800 active per day,\u00bb the cybersecurity company said. \u00abMore recent traffic toward SSH and other login portals suggests experimentation with distributed brute-force attacks; that capability\u2019s maturity remains uncertain.\u00bb<\/p>\n

Another notable aspect of the campaign is that it repurposes some of the compromised systems to scan the internet for similar instances, send an HTTP POST request to exposed ports on identified targets that instruct them to download the malware from the C2.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Lumen Black Lotus Labs has attributed the activity to an Italian-speaking threat actor with moderate confidence based on the presence of Italian-language artifacts and netflow indicators. The end goal of the campaign is to weaponize known vulnerabilities in publicly exposed services to enlist them into a cryptocurrency mining botnet and convert a subset of them into a scanner to expand the victim pool.<\/p>\n

\u00abAI infrastructure is becoming an attractive target,\u00bb Lumen said. \u00abExposed AI\/LLM services are valuable not only because of software vulnerabilities, but also because they may contain useful data and run on powerful hardware suitable for mining.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 07, 2026Botnet \/ Cryptojacking Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM)…<\/p>\n","protected":false},"author":1,"featured_media":3430,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[192,143,2068,567,42,1035,3698,777],"class_list":["post-3429","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-botnet","tag-crypto","tag-expand","tag-infects","tag-malware","tag-mining","tag-poellm","tag-servers"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3429","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3429"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3429\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3430"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3429"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3429"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3429"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}