CyberNew CyberNew
Vulnerabilities & CVEs BleepingComputer 1 week ago

PoeLLM malware infects exposed AI servers in cryptomining attacks

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads. The malware features an uncommon method to retrieve command-and-control (C2) addresses by extracting keywords in a poem hosted on GitHub. Researchers at Lumen's Black Lotus Labs (BLL) tracking the botnet malware say it has compromised more than 3,400..."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

PoeLLM malware infects exposed AI servers in cryptomining attacks

A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads.

The malware features an uncommon method to retrieve command-and-control (C2) addresses by extracting keywords in a poem hosted on GitHub.

Researchers at Lumen's Black Lotus Labs (BLL) tracking the botnet malware say it has compromised more than 3,400 servers, with peak activity reaching as many as 800 infected systems active on a single day.

PoeLLM has been active since at least April, but its activity has increased significantly since then, with at least 11 C2 servers spun up to date.

According to the research, the operation targeted systems across the United States and Western Europe.

Victims of PoeLLM
Source: Black Lotus Labs
Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →