Malware Activity
PoeLLM Botnet Turns Exposed AI/LLM Servers into Cryptomining Launchpads
A financially motivated campaign dubbed Canto Incognito is targeting exposed AI and LLM infrastructure with a new malware family called PoeLLM, turning compromised servers into cryptomining nodes, scanners, and exploit launchpads. Lumen Black Lotus Labs reports more than 3,400 victim servers, mostly in the US and Western Europe, with peaks of approximately 800 active systems per day. PoeLLM (an ELF binary masquerading as libgcrypt) uses a creative command-and-control (C2) mechanism that reads four (4) keywords from a poem (“On the Nature of Connection”) in a dash.css file on a GitHub repo, maps them via a hard‑coded dictionary to an IPv4 address, and thus derives the C2. Each time the operator changes the poem, the botnet points to a new C2, with at least eleven (11) having been used so far. The malware deploys XMRig and Iron miners, provides remote shell access, scans HTTP/S, and exploits exposed services like LiteLLM, Ollama, Gotenberg, Gitea, and Ivanti Sentry, including chaining LiteLLM vulnerabilities CVE‑2026‑42271 and CVE‑2026‑48710 for unauthenticated remote code execution (RCE). Compromised hosts are reused to scan ports 3000/4000 and push the malware to new targets, and some C2 servers appear to run on previously hacked routers. Lumen assesses with moderate confidence that the actor is Italian, based on code comments and netflow to an Italy‑based admin server. CTIX Analysts recommend that organizations and defenders patch affected services, reduce internet exposure for AI/LLM endpoints, restrict access to trusted IPs, and hunt for connections to BLL’s published IoCs.
- Bleeping Computer: PoeLLM Malware Article
- The Hacker News: PoeLLM Malware Article
- Lumen: PoeLLM Malware Report
Threat Actor Activity
Leaked Chats Expose Silent Ransom Group’s Plans for Physical Infiltration and Extreme Coercion
Leaked chat logs from August 2025 to September 2026 reveal the inner workings and ambitions of a Russia-based cyberextortion gang linked to the Silent Ransom Group (aka Luna Moth, Chatty Spider, and UNC3753). The archive, posted to a Tor site, shows members tracking dozens of mostly US law firms, negotiating multimillion‑dollar ransoms, and directing US-based operatives they call “agents” to physically infiltrate offices, matching an FBI flash report that warned of impostors posing as IT staff to copy data from on‑site machines. The chats mix real extortion records with brainstorming and violent fantasies, including plots to kidnap executives, sexually blackmail targets, and even recruit US sailors in gay bars near naval bases to spy on submarine‑based nuclear forces. There is no evidence that the extreme schemes were carried out. Agents were recruited via paid Telegram ads disguised as ordinary jobs. Victims were managed like a sales pipeline, with claimed settlements totaling roughly $200 million, though those figures aren’t independently verified. The gang also discussed operational security, avoiding iPhones, favoring low‑extradition countries, and rebranding as “Sleepless Threat” with the stated aim of becoming a cult‑like movement that inspires Americans to steal sensitive information “without being asked.”
Vulnerabilities
SonicWall and Splunk Patch Critical Vulnerabilities Amid Continued Threats to Enterprise Infrastructure
SonicWall and Splunk have released security updates addressing multiple critical- and high-severity vulnerabilities that could enable unauthorized access, remote code execution (RCE), and other malicious activity. SonicWall patched four (4) vulnerabilities affecting its SMA1000 appliances, including CVE-2026-102255 (CVSS 10/10), a pre-authentication server-side request forgery (SSRF) flaw that allows unauthenticated remote attackers to exploit an unintended access path to reach internal functionality and perform unauthorized operations. SonicWall also addressed three (3) additional vulnerabilities that could enable RCE and cross-site scripting (XSS), urging customers to upgrade to versions 12.5.0-03082 or 12.4.3-03670. Although no active exploitation of these newly patched flaws has been observed, Shadowserver identified more than 400 Internet-exposed SMA1000 appliances, highlighting potential exposure. The disclosure follows multiple SonicWall zero-day exploitation campaigns throughout 2026, including attacks linked to ransomware operations and malware deployment, reinforcing the continued targeting of enterprise VPN infrastructure. Meanwhile, Splunk patched dozens of vulnerabilities across Splunk Enterprise, MCP Server, and Add-on for Amazon Web Services, including three (3) critical flaws that could enable arbitrary command execution, unauthorized access, and code injection. Additional fixes address weaknesses involving attacker-controlled API requests and vulnerable third-party packages. CTIX analysts urge organizations to follow the guidance from both vendors and promptly apply security updates to mitigate potential exploitation and protect critical enterprise infrastructure.
- Bleeping Computer: SonicWall and Splunk Vulnerabilities Article
- SecurityWeek: SonicWall and Splunk Vulnerabilities Article
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
