Severity: HighIncidentSupply chain
Malware campaign targets exposed LLM infrastructure to deploy cryptominers across 3,400+ servers
Global
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
A financially-motivated malware family, tracked as Canto Incognito, has been observed actively compromising exposed AI and large language model (LLM) infrastructure across 3,400+ servers. The campaign deploys cryptocurrency miners to expand a botnet's operational capacity, exploiting inadequately secured AI deployments as entry points.
What to do
Implement network segmentation and zero-trust access controls to prevent LLM and AI infrastructure exposure to untrusted networks.
Mapped framework pillars
Sources
#LLM security#malware#cryptomining#botnet#exposed infrastructure#AI systems