PoeLLM malware infects exposed AI servers in cryptomining attacks
-
A cryptomining campaign is actively targeting exposed AI services, using malware tracked as PoeLLM to transform compromised servers into scanners and exploit launchpads. According to reporting from BleepingComputer, the operation focuses on AI infrastructure that is left accessible, turning those systems into both mining nodes and staging points for further attacks.
The key facts as reported:
- The malware family is called PoeLLM.
- The campaign targets exposed AI servers.
- Compromised hosts are repurposed for cryptomining and are also used to scan for and launch exploits against other systems.
- No specific CVE ID, KB number, or advisory ID is provided in the source reporting, so none is referenced here.
For defenders, the practical takeaway is that any AI service reachable from the internet should be treated as a high-value target. Exposure of these services gives attackers both compute for mining and a foothold to pivot outward, so reducing external attack surface and monitoring for unexpected outbound scanning activity are sensible priorities.
Source: BleepingComputer
Does your organization expose any AI services to the internet, and if so, how are you limiting access to them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login