PoeLLM Malware Targets Exposed AI and LLM Servers to Expand Crypto-Mining Botnet
Summary
The Canto Incognito campaign used PoeLLM malware to infect more than 3,400 exposed servers, mine cryptocurrency, and scan for additional targets. The GitHub repository used to derive its C2 addresses is no longer accessible.
Key points
- The financially motivated campaign has been active since April 2026 and infected more than 3,400 servers, primarily in the U.S. and Western Europe.
- Targets included exposed LiteLLM and Gotenberg deployments, as well as Gitea and Ivanti Sentry appliances.
- PoeLLM hides its command-and-control address in a poem hosted on GitHub; changing words in the poem lets the operators derive a new address.
- Infected systems ran cryptocurrency miners including XMRig and Iron, connecting victims to the Kryptex mining service.
- Some compromised servers were repurposed to scan for vulnerable systems and send requests instructing targets to download the malware.
- Lumen attributed the activity to an Italian-speaking actor with moderate confidence; evidence of distributed brute-force activity was described as preliminary.
- The poem repository is no longer accessible, and Lumen said null-routing the campaign's C2 infrastructure disrupted its operations.
Article Details
- Event Type
- Malware campaign targeting exposed AI/LLM and other internet-facing services to install cryptocurrency miners and expand a botnet.
- Impact
- More than 3,400 victim servers were identified, with infections concentrated in the U.S. and Western Europe. Compromised hosts were reused as scanners and exploit servers. The campaign's GitHub poem repository became inaccessible, disrupting the campaign; Lumen also reported that null-routing of prior and active C2s took effect. The maturity of reported distributed brute-force activity remains uncertain.
People
Malware
IronThe financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.PoeLLMThe malware distributed as part of the campaign has been codenamed PoeLLM owing to what has been described as a "creative" technique that hides the command-and-control (C2) address within a poem the threat actors wroteXMRigThe financially motivated campaign, dubbed Canto Incognito, has been found to install cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.
Vendors
Products
GiteaThe attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.GotenbergThe attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.Ivanti SentryThe attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.LiteLLMThe attacks have been primarily found to single out enterprise, internet-facing deployments such as LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances.
Countries
Italyon the attacker's GitHub pages are in Italian, and our netflow suggests that the attacker is located in Italy. Given that the malicious poem would have worked in any language, and the actor's own preference seems toUnited StatesApril 2026, with more than 3400 victim servers identified so far. The infections are concentrated in the U.S. and Western Europe.