Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
Stories per day · 30 days
3 RSS
5 stories, newest first · one card per story
Stories tagged #black-lotus-labs
Linux BambooToken Malware Uses MQTT C2 for Remote Shell Access and File Exfiltration
A Linux BambooToken backdoor uses MQTT on port 2883 for profiling, shell commands, and file theft.
3
BambooToken: The Malware That Speaks MQTT to Stay Under the Radar
Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.
3
BambooToken malware controls Windows and Linux systems via MQTT
Lumen Black Lotus Labs exposes BambooToken, a China-aligned malware framework using MQTT C2 to backdoor Windows and Linux systems at roughly a dozen enterprises.
2
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
DoJ corrected its statement to say US federal agencies were targets, not confirmed victims, of China-linked group QTFY's intrusions.
8