PoeLLM

Canto Incognito Malware Targets Exposed AI and LLM Infrastructure, Infects 3,400+ Servers

Researchers have identified the Canto Incognito malware campaign targeting exposed artificial intelligence and large language model infrastructure globally. The financially motivated operation has infected over 3,400 servers, deploying cryptocurrency miners and expanding the botnet's reach. The attack vectors involve accessing poorly secured AI/LLM endpoints, though specific exploitation details remain limited in initial reporting.