Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishers
- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption50
- Hype gap+5
- Incentives
- Insufficient
- Confidence70
The FBI and six other governments said on October 8 that hackers tied to Integrity Technology Group run a portal giving third parties access to stolen email. The firm, sanctioned by the US and UK, denies the accusations.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence58
The advisory puts Volt Typhoon inside communications, energy, transport and water IT environments across the US and Guam, and says the behaviour does not look like espionage. The planning problem is outage, not data loss.
Reality
- Evidence70
- Adoption58
- Hype gap+12
- Incentives55
- Confidence62
Black Lotus Labs assesses the botnet as Chinese state work under Flax Typhoon, assembled from SOHO routers, NVRs, NAS boxes and IP cameras whose 17-day average lifespan makes the infrastructure disposable by design.
Publishers:lumen.com
Reality
- Evidence58
- Adoption62
- Hype gap+15
- Incentives68
- Confidence57
DOJ seized three domains on 26 August 2026 and disabled the QScan and QTRouter platforms. Both were sold as services to MSS and PLA customers, and the only telemetry that ever saw the traffic sat on the backbone.
Publishers:zerotracelab.com
Reality
- Evidence74
- Adoption71
- Hype gap+12
- Incentives62
- Confidence63
Prosecutors say a Nanjing contractor rented IoT botnets and commercial proxies to the MSS and PLA from 2018. No individuals were charged, and the conscripted hardware stays conscripted.
Reality
- Evidence58
- Adoption47
- Hype gap+24
- Incentives62
- Confidence61
Lumen's Black Lotus Labs spent a year mapping a four-part framework sold to Chinese espionage operators. Its indicators belong to a supplier, so hunt the service rather than one group's habits.
Reality
- Evidence52
- Adoption58
- Hype gap+18
- Incentives66
- Confidence48