🤖 PoeLLM Malware Expands Cryptojacking Footprint

PoeLLM has reportedly infected more than 3,400 servers to grow a crypto-mining botnet, with compromised infrastructure repurposed for sustained illicit mining activity. The campaign, outlined in PoeLLM malware coverage, centers on server-side compromise at scale rather than endpoint delivery.

The server count indicates a mature monetization operation with enough distributed capacity to absorb takedowns and maintain output. For defenders, the key signal is not novelty but scale: broad server exposure can be converted directly into resilient mining throughput and persistent unauthorized resource consumption.

🛰️ Open sources - closed narratives
@sitreports