PoeLLM malware infects more than 3,400 servers, expanding a cryptocurrency mining botnet

Lumen Black Lotus Labs disclosed a malicious campaign named Canto Incognito, whose delivered PoeLLM malware has infected more than 3,400 AI and LLM infrastructures exposed to the internet, used to deploy cryptocurrency miners such as XMRig and Iron and connect to the Russian mining service Kryptex. The attacks primarily target enterprise external deployments such as LiteLLM, Gotenberg, Gitea, and Ivanti Sentry, with infections concentrated in the United States and Western Europe. The malware hides the command-and-control address in the words of a poem in a GitHub repository; each time the C2 changes, several words in the poem are altered, and the address is derived from the corresponding keys. Infected hosts are also turned into scanners and exploit servers, sending HTTP POST requests to exposed ports to lure downloads of the malware, expanding the botnet.