Kryptex

Headlines · 1

1. Oct 9
   PoeLLM cryptomining malware hid C2 addresses in a GitHub poem, hitting 3,400+ servers

   Lumen's Black Lotus Labs detailed a campaign it calls Canto Incognito, in which cryptomining malware named PoeLLM has infected more than 3,400 servers since at least April. Many victims appear to be internet-exposed open-source AI/LLM services such as LiteLLM and Ollama, along with the PDF-conversion API Gotenberg and self-hosted Git platform Gitea; the enterprise gateway Ivanti Sentry may also have been targeted. The malware decoded command-and-control addresses from four words in a two-stanza GitHub poem titled "On the Nature of Connection," revised 11 times so far, and dropped XMRig-based miners that turn infected hosts into scanners and exploit servers. Researchers stressed the poem is only C2 obfuscation, not prompt injection or a jailbreak style of "adversarial poetry."

   iThome 台湾 · 🔥 0

Experience and discussion from the community

Share my Kryptex experienceAsk about Kryptex