Executive Summary
The Canto Incognito campaign's PoeLLM malware has infected over 3,400 servers by targeting exposed AI and LLM infrastructure to deploy crypto miners.
What Happened
Cybersecurity researchers are calling attention to a new malware family that has been observed targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure with an aim to deploy cryptocurrency miners and further expand the scale of the botnet. The financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including
Vulnerability / Attack Technique
Compromise of exposed AI infrastructure for crypto mining
Technical Mechanism
Exposed LLM servers are infected and used for mining and botnet growth.
AI Security Category
LLM10:2025 Unbounded Consumption
Relevant Frameworks
RealGround Analysis
GPU servers for AI are attractive mining targets. RealGround analysis: never expose LLM servers without authentication.
Recommended Controls
- Keep LLM servers off the internet
- Monitor GPU usage for unexpected load
Related RealGround Service
AI CISO Advisory · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.