PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

Researchers have identified a new malware family that targets vulnerable artificial intelligence and large language model infrastructure to deploy cryptocurrency miners. This campaign, known as Canto Incognito, aims to expand a botnet and has already infected over 3,400 servers. The malware is financially motivated and installs cryptocurrency miners on compromised systems. The infected servers are being used to increase the scale of the botnet. The campaign specifically targets exposed AI and LLM infrastructure, taking advantage of vulnerabilities to gain access.