Canto incognito: tracking the PoeLLM malware

The report

Understand how early detection helped Black Lotus Labs uncover PoeLLM malware targeting enterprise AI systems and block its infrastructure to protect customers.

Read the full analysis: Canto incognito: tracking the PoeLLM malware (lumen.com).

Indicators

The report is tracked for context; no indicator from it met the bar for blocking (for example, it only names shared hosting).

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#15). This page is generated from that record and the report’s own title and summary; nothing is rewritten.