3,400+ servers hijacked by PoeLLM to scan for targets and mine crypto
Researchers identify a campaign using PoeLLM malware to hijack exposed AI infrastructure, turning thousands of servers into scanning hubs for further expansion.
Key points
- The Canto Incognito campaign has compromised over 3,400 servers hosting AI and large language model services.
- The malware, named PoeLLM, installs cryptocurrency miners and converts victims into scanners to find new targets.
- The attack targets exposed infrastructure, leveraging the financial motive of cryptomining to expand the botnet's scale.
A financially motivated cyber campaign dubbed Canto Incognito is actively compromising artificial intelligence infrastructure to build a large-scale botnet. According to reports from The Hacker News and BleepingComputer, the operation has infected more than 3,400 servers. The attackers are using a specific malware family known as PoeLLM to target exposed AI services and large language model (LLM) infrastructure.
The risk
The primary objective of the Canto Incognito campaign is cryptocurrency mining. Once the malware gains access to a server, it installs miners to exploit the machine's computational resources for financial gain. However, the threat extends beyond resource theft. BleepingComputer reports that the compromised servers are also converted into scanners and exploit launchpads. This means infected machines actively search for other vulnerable systems, allowing the botnet to expand its reach automatically. The malware effectively turns each victim into a node that helps the attackers find and compromise additional targets.
Who is exposed
The campaign specifically targets exposed AI and LLM infrastructure. The vulnerability lies in the exposure of these services to the internet without adequate protection. The Hacker News notes that cybersecurity researchers are highlighting this trend as a growing risk for organizations deploying AI models. Any server hosting AI services that is accessible from the public internet is a potential target. The attackers are not exploiting a specific software bug in the AI models themselves, but rather the insecure configuration of the hosting environment. This makes any organization that has deployed AI endpoints without strict network segmentation or access controls at risk.
Cost and compliance
The immediate cost to victims is the theft of computational resources, which translates to increased energy bills and degraded performance for legitimate users. Because the compromised servers are used as scanners, they may also be involved in attacking other third-party systems, potentially implicating the victim organization in broader malicious activity.
While the source material does not detail specific regulatory fines, the exposure of critical infrastructure to botnets can violate security standards and compliance frameworks that require protection of network assets. The scale of the infection, with over 3,400 servers affected, indicates a widespread issue that could impact organizational reputation and operational continuity.
What should you do?
Organizations should immediately audit their public-facing infrastructure to identify any exposed AI or LLM endpoints. Network administrators should restrict access to these services using strict firewall rules and authentication mechanisms to prevent unauthorized connections. Monitoring for unusual outbound traffic can help detect if a server has been compromised and is acting as a scanner for the botnet.
What to do and how to stay safe: PoeLLM
- Conduct an inventory of all AI and LLM services to ensure none are publicly accessible without authentication.
- Implement network segmentation to isolate AI infrastructure from the broader corporate network and the internet.
- Monitor server logs for signs of cryptomining activity, such as high CPU usage or connections to known mining pools.
- Review firewall configurations to block unauthorized inbound and outbound traffic from AI service endpoints.
Step-by-step guide: AI Governance Explained: Building Rules for Autonomous Systems
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the name of the malware used in this campaign?
The malware is named PoeLLM, and the broader campaign is referred to as Canto Incognito.
How many servers have been compromised so far?
According to The Hacker News, more than 3,400 servers have been infected.
What do the attackers do with the compromised servers?
They install cryptocurrency miners and convert the servers into scanners to find and exploit other vulnerable systems.
