AI orgs hit as 3,400 servers turned into crypto-mining and scanning hubs by Canto Incognito
The Canto Incognito campaign has infected thousands of exposed AI and LLM servers, using them to mine cryptocurrency and scan for further targets.
Key points
- The Canto Incognito campaign has compromised more than 3,400 servers running exposed AI and large language model infrastructure.
- Attackers deploy the PoeLLM malware to install cryptocurrency miners and turn compromised hosts into scanners for lateral expansion.
- The financially motivated operation uses compromised servers as launchpads to identify and infect additional vulnerable systems.
A financially motivated cyber campaign known as Canto Incognito has infected more than 3,400 servers hosting exposed artificial intelligence and large language model services. According to The Hacker News, the operation utilizes a malware family called PoeLLM to deploy cryptocurrency miners and expand the botnet’s reach. The compromised infrastructure is subsequently repurposed to scan for additional vulnerable targets, creating a self-perpetuating cycle of infection.
How does the Canto Incognito campaign operate?
The campaign targets AI and LLM infrastructure that is exposed to the internet without adequate protection. Once access is gained, the attackers install cryptocurrency miners to generate revenue. According to BleepingComputer, the campaign uses PoeLLM malware to transform these compromised servers into scanners. This allows the threat actors to use the stolen computing power to identify and exploit other vulnerable systems, effectively using the initial victims as a staging ground for further attacks.
What is the scale of the compromise?
Security researchers have identified over 3,400 servers that have been infected by this specific operation. The Hacker News reports that the malware family is specifically designed to target the growing sector of AI and LLM deployments. The large number of compromised hosts indicates that the campaign is actively scanning for and successfully exploiting misconfigured or unpatched AI services across the internet.
Why are AI servers targeted?
AI and large language model services often require significant computing resources and are frequently deployed in cloud environments. When these services are exposed to the public internet without proper authentication or network segmentation, they become attractive targets for automated scanning tools. The Canto Incognito campaign exploits this exposure to gain initial access. Once inside, the high-performance nature of AI servers makes them particularly effective for resource-intensive tasks like cryptomining and network scanning.
What should organizations do next?
Organizations deploying AI and LLM services should immediately audit their network configurations to ensure that these services are not unnecessarily exposed to the public internet. Implementing strict access controls, authentication mechanisms, and network segmentation can prevent unauthorized access. Monitoring for unusual outbound traffic or high CPU usage may also help detect early signs of compromise. As no specific patch or fix has been confirmed for this campaign, defensive measures focused on exposure reduction and detection are the primary line of defense.
Background: Large language models
Large language models are predictive engines trained on vast text corpora. They generate output by calculating the most likely next token based on context. They do not know truth, only probability. This explains hallucinations and the need for rigorous verification of all outputs.
Read the full guide: How Large Language Models Work: Mechanics, Limits, and Reality
What to do and how to stay safe: Canto Incognito
- Data classification must precede any permission to use generative tools.
- Automated agents require stricter isolation than simple chat interfaces.
- Audit trails must capture both prompts and responses for forensic analysis.
AI policies must balance innovation with strict data controls and human oversight. Start by classifying your data and restricting access to public models.
Step-by-step guide: AI Usage Policy Checklist for Secure Enterprise Deployment
General security guidance from the Sandbox Desk newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is PoeLLM malware?
PoeLLM is a malware family used in the Canto Incognito campaign to infect exposed AI and LLM servers, deploying cryptocurrency miners and turning hosts into scanners.
How many servers have been compromised by Canto Incognito?
According to The Hacker News, cybersecurity researchers have observed the malware infecting more than 3,400 servers.
Is there a patch available for this vulnerability?
The source material does not mention a specific patch or fix for the vulnerabilities exploited by the Canto Incognito campaign.
