A cryptomining campaign dubbed Canto Incognito has infected over 3,400 servers by exploiting exposed artificial intelligence services and developer tools, according to research published by Black Lotus Labs. The underlying malware, named PoeLLM, compromises internet-exposed machines, deploys mining payloads, and uses compromised systems to scan for additional targets.
Targeted Systems and Vulnerabilities
The campaign has been active since April 2026, with most victims located in the United States and Western Europe. Researchers report that compromised systems frequently run self-hosted, open-source AI utilities including LiteLLM and Ollama, alongside software development toolkits like Gitea and the Gotenberg PDF converter. Threat actors targeted default service ports and leveraged known flaws, such as a command injection vulnerability in LiteLLM tracked as CVE-2026-42271, to initiate payload downloads.
Obfuscated Command and Control via GitHub
To locate command and control (C2) servers without hardcoding static IP addresses, PoeLLM inspects a public GitHub repository maintained by the attacker. The malware retrieves a file named dash.css containing a poem titled "On the Nature of Connection." By extracting four specific words from fixed locations in the poem and matching them against a built-in dictionary, the malware calculates the numerical IPv4 address of the active C2 server. Between April and June 2026, the attacker updated the poem text 11 times to redirect infected hosts to new server locations.
Payload Delivery and Escalating Botnet Tactics
Upon gaining access, PoeLLM installs the XMRig and Iron cryptomining software, routing earnings to the Kryptex mining pool. Infected machines also receive interactive remote shell capabilities and automated network scanning tools designed to locate and exploit exposed ports on other devices. Black Lotus Labs observed recent instances of compromised nodes conducting SSH portal brute-force attempts, signaling early testing of distributed login attacks. The security group has implemented network blocks against known PoeLLM C2 IP addresses.
AI-generated editorial illustration; not a documentary photograph.
Source: Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
SIGNAL TITANS
Leave a Reply