The PoeLLM malware campaign has infected more than 3,400 servers, using exposed AI and LLM infrastructure for cryptocurrency mining and botnet expansion, according to reporting published October 9. The campaign underscores the operational risk of internet-exposed model-serving and adjacent infrastructure.
What defenders should do
Inventory AI and LLM services, remove unnecessary public access, patch underlying platforms, and monitor for unexpected processes, resource spikes, and outbound connections. Detection coverage should extend to the host and orchestration layers around AI workloads, not only the application interface.
Source: The Hacker News.