PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

A malware family named PoeLLM has infected over 3,400 servers by targeting exposed AI and LLM infrastructure, repurposing them for cryptocurrency mining and botnet expansion. The campaign, dubbed Canto Incognito, uses compromised servers to scan and exploit other vulnerable systems, connecting victims to the Kryptex mining service. The malware retrieves its command-and-control address from a poem hosted in a GitHub repository, with changes to the poem indicating C2 updates. The activity is attributed to an Italian-speaking threat actor with moderate confidence, targeting enterprise services like LiteLLM, Gotenberg, Gitea, and Ivanti Sentry.

AI-extracted · verify before operational use