The PoeLLM botnet turns 3,400 AI servers into a mining farm via a poem
On October 7, 2026, Lumen Black Lotus Labs detailed ’Canto Incognito’, a campaign that infects more than 3,400 exposed servers — LiteLLM, Gotenberg, Gitea, Ivanti Sentry — to turn them into cryptocurrency miners, hiding its command-and-control address inside a poem hosted on GitHub. Any internet-facing AI instance must be inventoried, because that surface is exactly what the campaign scans to grow.
October 7, 2026. Lumen Black Lotus Labs detailed a cryptomining campaign named Canto Incognito, whose malware has been codenamed PoeLLM. Since April 2026. The activity began in the spring and has already identified more than 3,400 victim servers. A poem as an address. The command-and-control (C2) server is not hard-coded: its address is derived from a poem hosted in a GitHub repository. Why it matters: the campaign deliberately targets internet-exposed AI and LLM infrastructure — not to steal data, but to exploit the compute power of its GPUs as a mining farm, then recycle the compromised machines into scanners that grow the botnet.
A C2 hidden inside a poem
The campaign’s signature is its command-and-control mechanism. The PoeLLM malware does not contain a fixed control address. It computes one from a poem the attackers wrote — most likely with a generative AI model, according to analysts — and hosted in a public GitHub repository, github.com/ejejejdfbbebe. The repository’s first commit dates from April 13, 2026.
The principle is clever. “Each time they set up a new C2, they change a few words in the poem, and the malware derives the address from the key associated with those words”, explains Ryan English, an information security engineer at Lumen Technologies. The result: the control infrastructure can rotate without a single blockable, reportable address ever appearing in the malware samples. Moving to a new control server is just a rewrite of a few lines of verse.
Attribution, for its part, remains cautious. The malware’s comments and the attackers’ GitHub pages are written in Italian, and network telemetry points toward an operator based in Italy. Lumen describes a “moderate confidence” attribution to an Italian-speaking actor. The poem would have worked in any language, but the actor’s preference for Italian reinforces the hypothesis of AI-assisted generation — an operator weaponizing the very tooling it targets.
Why target AI infrastructure
The choice of victims is not random. The campaign primarily goes after enterprise, internet-facing deployments: LiteLLM, the gateway that unifies access to dozens of models, Gotenberg, the document-conversion service, Gitea, the self-hosted code forge, and Ivanti Sentry appliances. All are software an organization exposes deliberately, often with default credentials or unpatched versions.
The motive is economic. Once a machine is compromised, the malware installs miners — XMRig and Iron — and connects the victim to Kryptex, a Russian mining service that monetizes compute power. LLM inference servers are an attractive target for one simple reason: they carry powerful, expensive GPUs that sit underused overnight. “AI infrastructure is becoming an attractive target”, Lumen notes, “not only because of software vulnerabilities, but also because it may contain useful data and run on powerful hardware suitable for mining.”
The numbers give the scale. More than 3,400 servers have been identified as victims, concentrated in the United States and Western Europe. At the peak of operations in mid-June 2026, the campaign involved almost 2,200 affected servers, with nearly 800 active per day. More recent traffic toward SSH and other login portals suggests experimentation with distributed brute-force attacks, whose maturity remains uncertain.
A compromise chain that feeds itself
The campaign stands out less for its intrusion technique than for its growth economics. Lumen describes a mechanism in which “compromised hosts are reused to expand the botnet”: infected servers are turned into scanners and exploit servers, letting the actor find and compromise additional vulnerable systems without any infrastructure of its own.
Concretely, a subset of the compromised machines is tasked with scanning the internet for similar instances, then sending an HTTP POST request to exposed ports on identified targets — an instruction that makes them download the malware from the C2. Every victim thus becomes a recruitment node. That is what makes the campaign resilient: cutting off one C2 does not stop the scanners already deployed, and the poem lets the actor spin up another without recompiling the malware.
The end goal fits in one sentence: weaponize known vulnerabilities in exposed services into a mining botnet, and convert a fraction of that fleet into scanners to widen the victim pool. This is far from ransomware or exfiltration: the actor is after a quiet rent — diverted compute power, billed onto the victim’s electricity and cloud invoices.
How to spot a mining instance
Cryptomining has an operational signature that is easy to detect, if you look. A server that mines consumes CPU or GPU continuously, including overnight and on weekends, with no correlation to application traffic. Three checks are enough to remove the doubt: monitor load outside working hours, look for unknown processes tied to XMRig or Iron — by name, path, or arguments —, and inspect outbound connections to mining services like Kryptex or to public repositories acting as C2 resolvers.
Teams can also harden the entry surface. The campaign’s targets — LiteLLM, Gotenberg, Gitea, Ivanti Sentry — are protected first by ceasing to be exposed at the front, then by applying the patches for the known vulnerabilities the campaign exploits. The trap to avoid is believing an LLM gateway is an internal tool: the moment it listens on the internet, it is a perimeter.
What this says about LLM service exposure
The most important angle for a CISO is not the poem, but the gap it reveals. Teams are deploying LLM gateways like LiteLLM at a pace that inventory, patch management, and monitoring have not matched. An inference gateway is a stateful service, rich in API secrets, often exposed at the front for developer convenience — and rarely treated with the rigor of a traditional production service.
Canto Incognito is a symptom of a larger problem: the AI attack surface is growing faster than its defenses. Lumen puts it plainly — “exposed AI/LLM services are valuable not only because of software vulnerabilities, but also because they may contain useful data and run on powerful hardware”. Mining is the first, simplest monetization; nothing stops a later actor from using the same entry point to exfiltrate API keys or inference data.
Cryptojacking has cycled in and out of fashion with cryptocurrency prices. What has changed this time is the target. The spread of self-hosted LLM gateways has created a population of powerful, internet-reachable machines that operators still treat as developer tooling rather than as production infrastructure. Canto Incognito is unlikely to be the last campaign to notice the gap between how fast those services are deployed and how slowly they are secured. Lumen’s report is a preview of the next generation of botnets: quiet, self-expanding, and aimed at the most compute-dense assets an organization runs.
Verdict
If you run LiteLLM, Gotenberg, Gitea, or an Ivanti appliance exposed to the internet, start by pulling them off direct exposure or placing them behind strong authentication and an IP allowlist, then check for miners (XMRig, Iron) and unusual scanning processes. If you host LLM inference instances, treat them as critical assets: inventory, patch, and monitor CPU/GPU load outside working hours — a server that mines overnight shows up as abnormal consumption. For everyone, watch for indirect C2 resolvers: a public repository serving as a lookup table is harder to block than an IP address, and it demands detection by behavior rather than blacklist.