Security researchers have identified a cryptomining campaign, Canto Incognito, that has infected over 3,400 servers.
The operation focuses on unpatched versions of AI services like LiteLLM and Ollama.
The attackers utilize a novel command-and-control mechanism, embedding instructions within a two-stanza poem hosted on GitHub.
This repository has been updated 11 times to redirect nodes, which are then used for both mining XMRig/Iron and scanning for additional vulnerable targets.
How the attack works
The perpetrators hide the addresses they use to control the infected systems within the poem's content. Each time they want to redirect the systems to a new location, they modify the poem's text. So far, they have changed it 11 times.
The problem mainly affects computing systems that use artificial intelligence services, such as LiteLLM and Ollama, if they do not have the necessary security updates installed. Attackers target these systems because they have powerful hardware, which is particularly efficient for mining digital currencies.
The course of the attack
Once a system is infected, mining programs such as XMRig and Iron, which are connected to the Kryptex service infrastructure, are activated. Furthermore, the infected system becomes a tool for spreading the attack, searching for other unsuspecting systems on the internet to infect them in turn.
The attack was detected and reported by Lumen's Black Lotus Labs team. According to the research, the motives of the perpetrators are financial. The company has already blocked communication to the control locations used by the perpetrators, limiting the ability to send new commands to the infected systems.
Top comments (0)