PoeLLM Malware Infects Exposed AI Servers for Cryptomining: Detection and Hardening Guide

---
title: AI Inference Service Spawning Shell or Download Utility
id: 3f9c2a71-8b44-4e1a-9c6d-2a7f5b8e1d03
status: experimental
description: Detects LLM inference server processes (Ollama, vLLM, text-generation-webui, LocalAI) spawning shells or download utilities, consistent with PoeLLM initial-access and payload staging behavior.
references:
  - https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/ollama'
      - '/vllm'
      - '/text-generation-webui'
      - '/localai'
      - 'python'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/chmod'
      - '/crontab'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate model download tooling or custom inference wrappers that shell out to curl
level: high
---
title: Cryptominer Execution from Ephemeral or World-Writable Path
id: 8e1d4b62-5c09-4f3a-b712-9d4e6a2c7f15
status: experimental
description: Detects execution of binaries from /tmp, /dev/shm, or /var/tmp combined with known miner names or mining pool command-line arguments, as used by the PoeLLM payload staging stage.
references:
  - https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.impact
  - attack.t1496
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  selection_miner:
    CommandLine|contains:
      - 'xmrig'
      - '--donate-level'
      - 'stratum+tcp'
      - 'stratum+ssl'
      - 'moneroocean'
      - 'supportxmr'
      - '--coin'
      - '-o pool.'
  selection_name:
    Image|endswith:
      - '/xmrig'
      - '/kdevtmpfsi'
      - '/kinsing'
      - '/pnscan'
      - '/masscan'
  condition: selection_name or (selection_path and selection_miner)
falsepositives:
  - Rare; ephemeral paths combined with mining-pool arguments are almost never legitimate
level: critical
---
title: Persistence via Cron or Systemd from User-Writable Locations
id: 2c7a5e94-6d31-4b8f-a023-5e9b1c4d8f62
status: experimental
description: Detects cron or systemd persistence referencing scripts or binaries in /tmp, /dev/shm, or /var/tmp — a common PoeLLM persistence mechanism for surviving reboots on compromised AI servers.
references:
  - https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/
  - https://attack.mitre.org/techniques/T1053/003/
  - https://attack.mitre.org/techniques/T1543/002/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.persistence
  - attack.t1053.003
  - attack.t1543.002
logsource:
  category: file_event
  product: linux
detection:
  selection_dir:
    TargetFilename|startswith:
      - '/etc/cron'
      - '/var/spool/cron'
      - '/etc/systemd/system/'
      - '/usr/lib/systemd/system/'
  selection_content:
    TargetFilename|contains:
      - 'tmp'
      - 'shm'
  selection_generic:
    TargetFilename|startswith:
      - '/etc/cron.d/'
      - '/var/spool/cron/crontabs/'
  condition: (selection_dir and selection_content) or selection_generic
falsepositives:
  - Legitimate cron entries created by configuration management (Ansible, Chef) — baseline and exclude known provisioning sources
level: high

// PoeLLM hunt: AI servers fetching payloads, miner behavior, and outbound scanning
// Assumes Linux Syslog/auditd ingestion into Sentinel (Syslog table) plus Defender for Endpoint where deployed.

// 1. Shell-piped downloads and miner indicators on Linux hosts via auditd/Syslog
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName in~ ("bash", "sh", "curl", "wget", "crontab", "systemctl")
| where SyslogMessage has_any (
    "curl -s", "wget -q", "| sh", "| bash", "|sh", "|bash",
    "xmrig", "stratum+tcp", "stratum+ssl", "--donate-level",
    "/dev/shm", "/var/tmp/", "moneroocean", "supportxmr")
| extend SuspiciousPath = iif(SyslogMessage has_any ("/tmp/", "/dev/shm/", "/var/tmp/"), true, false)
| where SuspiciousPath or SyslogMessage has_any ("xmrig", "stratum+", "--donate-level")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), SampleCommands=make_set(SyslogMessage, 10)
  by Computer, ProcessName
| order by FirstSeen desc;

// 2. Outbound scanning behavior: single host fanning out to many distinct public IPs on AI service ports
// (Ollama 11434, vLLM/OpenAI-compatible 8000/8080, Docker API 2375) — the PoeLLM weaponization stage.
Syslog
| where TimeGenerated > ago(24h)
| where SyslogMessage has_any ("DPT=11434", "DPT=8000", "DPT=8080", "DPT=2375") and SyslogMessage has "SYN"
| parse SyslogMessage with * "SRC=" SourceIP " " * "DST=" DestIP " " * "DPT=" DestPort " " *
| where not(ipv4_is_private(DestIP))
| summarize DistinctTargets=dcount(DestIP), Ports=make_set(DestPort) by Computer, SourceIP
| where DistinctTargets > 50
| order by DistinctTargets desc;

-- Velociraptor hunt: identify PoeLLM-style compromise on Linux AI servers.
-- Collects suspicious processes, cron/systemd persistence, and ephemeral-path binaries.
SELECT * FROM chain(
  a = {
    -- Stage 1: live processes executing from ephemeral paths or with miner strings
    SELECT Pid, Name, Exe, Commandline, Username
    FROM pslist()
    WHERE Exe =~ '/(tmp|dev/shm|var/tmp)/'
       OR Commandline =~ '(?i)(xmrig|stratum\+|--donate-level|moneroocean|supportxmr)'
  },
  b = {
    -- Stage 2: cron persistence artifacts
    SELECT FullPath AS Artifact, 'cron' AS Type, Size, Mtime
    FROM glob(globs=['/etc/cron.d/*', '/etc/cron.daily/*', '/var/spool/cron/*', '/var/spool/cron/crontabs/*'])
  },
  c = {
    -- Stage 3: recently modified or non-standard systemd units
    SELECT FullPath AS Artifact, 'systemd' AS Type, Size, Mtime
    FROM glob(globs=['/etc/systemd/system/*.service'])
    WHERE Mtime > now() - 604800  -- units modified in the last 7 days
  },
  d = {
    -- Stage 4: binaries dropped in world-writable/ephemeral paths
    SELECT FullPath AS Artifact, 'dropped_binary' AS Type, Size, Mtime
    FROM glob(globs=['/tmp/*', '/dev/shm/*', '/var/tmp/*'])
    WHERE NOT IsDir
  }
)

#!/bin/bash
# poeLLM_triage_harden.sh — triage and harden exposed AI inference servers.
# Run as root. Review output before enabling the firewall section.
set -euo pipefail

echo "=== [1] Suspicious processes: miners, scanners, ephemeral-path binaries ==="
ps auxww | grep -Ei 'xmrig|kinsing|kdevtmpfsi|masscan|pnscan|stratum|donate-level' | grep -v grep || echo "None found"
ls -la /tmp /dev/shm /var/tmp 2>/dev/null | grep -vE '^total|^d' || true

echo "=== [2] Persistence: cron and systemd ==="
crontab -l 2>/dev/null; ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null
grep -rEl '/tmp/|/dev/shm/|/var/tmp/' /etc/systemd/system/ 2>/dev/null || echo "No systemd units referencing ephemeral paths"
systemctl list-unit-files --state=enabled | grep -viE 'ssh|cron|systemd|network|rsyslog|cloud-init|docker|containerd' || true

echo "=== [3] Exposure check: is an AI service listening on a public interface? ==="
ss -tlnp | grep -E ':(11434|8000|8080|2375|5000)\b' || echo "No common AI service ports listening"

echo "=== [4] Outbound scanning connections from this host ==="
ss -tnp state established | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

echo "=== [5] HARDEN: bind Ollama to localhost only (systemd override) ==="
if systemctl list-unit-files | grep -q '^ollama.service'; then
  mkdir -p /etc/systemd/system/ollama.service.d
  cat > /etc/systemd/system/ollama.service.d/override.conf <<'EOF'
[Service]
Environment="OLLAMA_HOST=127.0.0.1:11434"
EOF
  systemctl daemon-reload
  systemctl restart ollama
  echo "Ollama bound to 127.0.0.1 — expose it via an authenticated reverse proxy if remote access is required."
fi

echo "=== [6] HARDEN: default-deny egress for mining pools and scanning (ufw) ==="
# Uncomment after validating dependencies — blocks outbound stratum and AI-port fan-out.
# ufw default deny outgoing
# ufw allow out 53; ufw allow out 80; ufw allow out 443; ufw allow out 123/udp
# ufw enable

echo "=== Done. Re-image any host with confirmed miner artifacts — do not trust in-place cleanup. ==="