[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ffQWVLA_t5KALSscCHC-jxoEdlFpBUZGHcXFKQwqujEE":3},{"article":4,"iocs":47,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"319c1a3e-b873-4cc4-be14-c274b238897c","PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet","poellm-malware-infects-3-400-servers-to-expand-crypto-mining-botnet-99a195","Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet. The financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including","A new malware family named PoeLLM, part of the Canto Incognito campaign, is targeting exposed AI and LLM infrastructure to deploy cryptocurrency miners like XMRig and Iron. The malware uses a novel technique to hide its C2 address within a poem hosted on GitHub. Over 3,400 servers have been infected, primarily in the U.S. and Western Europe, with compromised hosts repurposed to scan for and infect additional vulnerable systems.","PoeLLM malware targets AI\u002FLLM infrastructure to expand crypto mining botnet.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fpoellm-malware-infects-3400-servers-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhDjQ8O0UFcl1dpOxEJoAM0s1mXXZHJNpJF4uJV_4jg7UPhHlDEvGHVxHKtyZQpnFC4HC3stGB-jJOSYUB5vdayfwx_eWPq-0F_l_ViYZNcA768t1N95JWhhbhUzY8anGOjVSL06QtsKVv_mz4lKgGrBMNBckAtFPxaW-KuG3mbWuUJrsyJP2vdWVbq8r9P\u002Fs1600\u002Fcrypto.jpg","2026-10-07T15:33:51+00:00","2026-10-07T18:00:14.350745+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Italian-speaking threat actor","threat_actor",{"name":21,"type":22},"Canto Incognito","campaign",{"name":24,"type":25},"Lumen","vendor",{"name":27,"type":28},"XMRig","product",{"name":30,"type":28},"Iron","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,51,53],{"type":35,"value":49,"context":50},"PoeLLM","Name of the new malware family",{"type":35,"value":27,"context":52},"Cryptocurrency miner deployed by PoeLLM",{"type":35,"value":30,"context":52},[24,27,30],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":87,"name":88,"problem":89,"products":90},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":109,"url":112,"description":113},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":115,"name":116,"problem":117,"products":118},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":160},"poellm-botnet-exploits-exposed-ai-infrastructure-to-mine-crypto-on-3400-servers","PoeLLM Botnet Exploits Exposed AI Infrastructure to Mine Crypto on 3,400+ Servers","The PoeLLM malware campaign highlights the critical risk of leaving AI and LLM infrastructure publicly exposed without proper hardening or access controls. Attackers exploited misconfigured or insufficiently secured servers to deploy cryptocurrency miners, effectively stealing compute resources at scale. A novel C2 obfuscation technique — hiding command-and-control addresses inside a poem on GitHub — demonstrates how adversaries are evolving to evade traditional detection methods. Compromised servers were then weaponized to propagate the botnet further, amplifying the damage exponentially. This attack underscores that emerging AI infrastructure carries the same — if not greater — attack surface risks as traditional systems and must be treated accordingly.",[149,150,151,152,153,154,155,156,157,158,159],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 7 – Continuous Vulnerability Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-6 (Configuration Settings)","NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 CA-7 (Continuous Monitoring)","NIST SP 800-53 SC-7 (Boundary Protection)","NIST CSF DE.AE-1 (Anomalies and Events)","MITRE ATT&CK T1496 (Resource Hijacking)","MITRE ATT&CK T1568 (Dynamic Resolution \u002F C2 Obfuscation)",{}]