Key points
- The campaign targets exposed artificial intelligence and large language model infrastructure.
- Compromised servers are converted into scanners to identify additional vulnerable systems.
- Researchers have identified over 3,400 infected servers in the botnet.
A financially motivated cybercrime campaign dubbed Canto Incognito is actively compromising exposed artificial intelligence services to expand its cryptocurrency mining operations. According to reports from BleepingComputer and The Hacker News, the group relies on a specific malware family known as PoeLLM to gain initial access and maintain control over these systems. The operation transforms compromised AI servers into active participants in the attack chain, using them as launchpads for further exploitation.
By the numbers
- 3,400+: The number of servers identified as infected by the PoeLLM malware, according to The Hacker News.
- 1: The primary objective of the campaign, which is the deployment of cryptocurrency miners.
- 1: The malware family used for initial compromise and botnet expansion, known as PoeLLM.
What the figures mean
The scale of the infection, exceeding 3,400 servers, indicates a highly automated and widespread exploitation effort. The Hacker News reports that cybersecurity researchers are tracking this new malware family as it targets exposed AI and large language model (LLM) infrastructure. The primary goal is financial gain through cryptomining, but the method of expansion is technically distinct. Rather than relying solely on external scanning tools, the campaign leverages the compromised servers themselves.
According to BleepingComputer, the PoeLLM malware turns the infected AI servers into scanners. This means the botnet uses the compute power and network position of the victim machines to probe for other vulnerable AI services. This peer-to-peer scanning approach allows the botnet to grow organically and rapidly, bypassing some traditional perimeter defenses that might filter external scan traffic. The infected servers act as exploit launchpads, seeking out other exposed endpoints to install additional miners and expand the Canto Incognito network.
The targeting of AI and LLM infrastructure suggests that threat actors are prioritizing high-value, compute-intensive environments. These servers often have open ports or exposed APIs that are necessary for their function, creating attack surfaces that are difficult to close without disrupting service. The malware’s ability to repurpose these resources for scanning highlights the dual threat: immediate resource theft via mining and long-term network instability via lateral movement.
What to watch
Security operations teams should prioritize identifying and remediating exposed AI and LLM services that are accessible from the public internet. Since the malware uses compromised hosts to scan for new victims, isolating infected systems is critical to stopping the spread. Monitoring for unusual outbound traffic from AI servers, particularly traffic directed toward other AI service ports, may indicate active scanning behavior.
While no specific CVE IDs or software versions are cited in the current reports, the vulnerability likely stems from misconfiguration or lack of authentication on AI endpoints. Teams should verify that all AI inference and training services are properly authenticated and not exposed directly to the internet without a firewall or access control list. As the Canto Incognito botnet continues to grow, the volume of scanning traffic from compromised AI infrastructure may increase, potentially impacting network performance and alerting systems.
What to do and how to stay safe: PoeLLM
- Network logs reveal shadow AI through unique TLS fingerprints and high-volume outbound JSON payloads.
- Endpoint telemetry shows unexpected GPU usage and memory patterns distinct from standard applications.
- Behavioral analysis detects clipboard harvesting and context switching that indicates manual model prompting.
Shadow AI leaves distinct behavioral and network fingerprints that standard tools often ignore. Implement monitoring for GPU usage anomalies and unusual TLS fingerprints to catch these hidden tools.
Step-by-step guide: Detect Shadow AI: Network Logs, Process Trees and Hidden Signals
General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the primary purpose of the Canto Incognito campaign?
The campaign aims to deploy cryptocurrency miners on compromised servers and expand the botnet scale.
How does the PoeLLM malware help the botnet grow?
It turns compromised AI servers into scanners that look for other vulnerable systems to infect.
How many servers have been affected by this malware?
Researchers have identified more than 3,400 infected servers.
