- Published on
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
- Authors
- Name
- DeepHorus
Cybersecurity researchers have uncovered a new malware family, PoeLLM, targeting exposed AI and large language model infrastructure. The campaign, called Canto Incognito, installs cryptocurrency miners and expands a botnet. It has infected more than 3,400 servers since April 2026.
Lumen Black Lotus Labs said compromised hosts are reused to expand the botnet. Infected servers become scanners and exploit servers, finding more vulnerable systems. The malware installs XMRig and Iron miners, connecting victims to Kryptex, a Russian crypto mining service.
PoeLLM uses a creative technique: it hides its command-and-control address inside a poem hosted on GitHub. The first commit was April 13, 2026. Each new C2 changes a few words in the poem, and the malware derives the address from the key associated with those words. Researchers believe the poem was likely AI-written.
Targets include enterprise internet-facing deployments like LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances. The goal is to abuse their compute power for illicit mining. Infections are concentrated in the U.S. and Western Europe. At the peak in mid-June, nearly 2,200 servers were affected, with nearly 800 active daily.
The campaign also repurposes some systems to scan the internet for similar instances. They send HTTP POST requests to exposed ports, instructing targets to download malware from the C2. Recent traffic toward SSH and login portals suggests experimentation with distributed brute-force attacks, though maturity is uncertain. Lumen attributes the activity to an Italian-speaking actor with moderate confidence.
"AI infrastructure is becoming an attractive target," Lumen said. Exposed AI/LLM services are valuable due to software vulnerabilities, useful data, and powerful hardware suitable for mining. In an update, the GitHub repo staging the poem is no longer accessible, disrupting the campaign. Lumen's Ryan English said it was likely the only repo and was fully disrupted. The null-route of C2s took effect early Tuesday night; the actor may have noticed, or GitHub may have flagged abuse.
