Somebody out there is turning self-hosted AI labs and dev servers into a secret poetry-reading botnet, and they are getting paid for it. Researchers at Lumen Technologies’ Black Lotus Labs have disclosed a campaign dubbed Canto Incognito that uses custom Linux malware called PoeLLM to infect exposed infrastructure and mine cryptocurrency, quietly compromising more than 3,400 servers since April 2026. Most of those victims are running open-source AI and developer tools like LiteLLM, Ollama, Gitea, Gotenberg, and Ivanti Sentry gateways, making this one of the first large-scale cryptomining operations aimed directly at the booming DIY AI stack.
At the heart of PoeLLM is an almost whimsical trick: the botnet’s command-and-control address is encoded inside a short poem hosted on GitHub. The malware, an ELF binary masquerading as a library named libgcrypt, fetches a file called dash.css from a repository that appears to be a fork of Node.js and reads a two-stanza poem titled “On the Nature of Connection.” From that verse it extracts four specific words or phrases and converts them via a custom key into an IPv4 address, which becomes the active C2 server for infected hosts. Lumen’s team says the poem has been edited at least 11 times, with each commit subtly swapping those four tokens to point the botnet at new infrastructure while leaving the decoding pattern unchanged. Security researchers note that the verse is used purely as an obfuscated configuration file, not as some kind of “adversarial poetry” jailbreak or prompt injection attack against LLMs.
Once a target is compromised, PoeLLM is far from poetic in what it does next. The malware deploys XMRig and Iron miners and connects them to the Russian Kryptex mining service, effectively renting out victims’ CPUs and GPUs to generate cryptocurrency for the operator. The implant also includes remote shell capabilities, HTTP and HTTPS scanning, and exploit-delivery tooling, turning each infected machine into both a worker and a scout that crawls the internet for more exposed services to hit. Black Lotus Labs observed up to around 800 systems actively participating on peak days and identified a dozen distinct C2 servers, at least some of which sat on compromised consumer routers, a classic trick for hiding backend infrastructure. Help Net Security and other outlets report that the actor appears to be Italian-speaking and clearly financially motivated, with no obvious political or espionage angle beyond monetizing accessible compute.
The victims’ software stack reads like a who’s who of home-lab and startup tooling. LiteLLM, an “AI gateway” proxy that lets apps hit multiple large language models through a single endpoint, is one major entry point, and Lumen’s analysis ties exploitation to a flaw in its connection endpoint where commands supplied in a crafted POST request could be executed on the host without any role checks. That bug, tracked as CVE-2026-42271 and later added to CISA’s catalog of exploited vulnerabilities, was patched in LiteLLM version 1.83.7 and above, but many servers apparently stayed exposed. Ollama, which lets users run open-weight models locally on their own hardware, was also targeted, along with Gitea (self-hosted Git), Gotenberg (Dockerized PDF and document conversion), and Ivanti Sentry mobile gateway appliances, though Lumen has not yet published full exploit chains for those services. Notably, Gotenberg’s own documentation cautions administrators not to expose it directly to the public internet, a warning this campaign demonstrates was well founded.
Beyond the novelty of hiding C2 settings in a poem, Canto Incognito underscores how attractive AI infrastructure has become to criminals. Public-facing LLM gateways and inference boxes often sit on powerful GPUs and fast networks, and they can hold logs, prompts, and training data from internal applications—making them valuable both for raw compute and potential data theft. Self-hosted AI services also tend to be spun up quickly by small teams or hobbyists, sometimes without the hardened configurations or monitoring that more traditional production web apps receive. Cybersecurity bulletins note that this is not the first cryptomining botnet to abuse misconfigured APIs, but it is one of the clearest examples where AI-specific services like LiteLLM and Ollama are explicitly called out as primary targets rather than collateral victims. Meanwhile, researchers draw a line between PoeLLM’s operational use of verse and academic work on adversarial poetry against models, stressing that here the poem functions as camouflage for machine instructions, not a weaponized prompt aimed at the AI itself.
For admins, researchers, and tinkerers running AI stacks at home or in small labs, the takeaway is sobering but actionable. Lumen has published indicators of compromise—hashes, domains, and log patterns—for PoeLLM, and recommends checking connection logs against those artifacts and blocking any traffic to known C2 infrastructure. Operators should upgrade LiteLLM to at least version 1.83.7, apply the latest Ivanti Sentry firmware releases (R10.5.2, R10.6.2, or R10.7.1), and audit the exposure of services like Gitea and Gotenberg, closing unnecessary ports and placing sensitive tools behind proper authentication and reverse proxies. Security teams also advise treating AI gateways the same way they would treat payment APIs or admin consoles: with strict access controls, routine patching, and continuous monitoring, rather than assuming “lab” services are too obscure to attract attention. The PoeLLM campaign may be reading its orders from a poem, but its impact is very real, and it is a reminder that in 2026 even your experimental LLM sandbox needs production-grade security.
