The PoeLLM botnet turns 3,400 AI servers into a mining farm via a poem

On October 7, 2026, Lumen Black Lotus Labs detailed ’Canto Incognito’, a campaign that infects more than 3,400 exposed servers — LiteLLM, Gotenberg, Gitea, Ivanti Sentry — to turn them into cryptocurrency miners, hiding its command-and-control address inside a poem hosted on GitHub. Any internet-facing AI instance must be inventoried, because that surface is exactly what the campaign scans to grow.