Thousands of computers infected with malware that generates digital currencies

Security experts have discovered a crypto-mining operation, named Canto Incognito, that has compromised more than 3,400 servers. The malicious campaign primarily targets unpatched Artificial Intelligence services, such as LiteLLM and Ollama, which possess powerful hardware ideal for mining digital currencies. The attackers employ a unique command-and-control method, concealing their control addresses within a two-stanza poem hosted on GitHub.

This repository has been updated 11 times to redirect infected nodes, which are subsequently utilized for mining cryptocurrencies and searching for additional vulnerable targets. The poem's text is altered each time a new redirection is needed. The infection primarily impacts computing systems that have AI services with insufficient security updates.

Once a system is compromised, mining software like XMRig and Iron, connected to the Kryptex service infrastructure, is activated. The infected system then serves to spread the attack by hunting for other susceptible systems on the internet. The attack's objectives are financially motivated, and the perpetrators have already blocked communication to the control locations used by the attackers, restricting the capability to send new commands to the infected systems. Lumen's Black Lotus Labs team identified and reported the attack.