The PoeLLM malware family targets exposed AI and language model infrastructure, compromising over 3,400 servers to deploy cryptocurrency miners and grow the Canto Incognito botnet.
The Carbonato malware exploits exposed Docker daemons by deploying the Hermes Agent AI framework to control infected hosts, marking an evolution in AI-driven hijacking.
Evooo1Bot is a new Mirai-based Linux botnet targeting internet-facing routers to convert them into SOCKS5 traffic relay nodes, expanding attack surfaces.
The NadMesh Go botnet targets exposed AI services to harvest over 3,800 unique AWS keys, threatening cloud and Kubernetes environments.