PoeLLM Hides Its C2 Address in a Poem, Infecting 3,400+ Servers

Researchers at Lumen Black Lotus Labs have detailed a new malware family that preys on internet-facing artificial intelligence and large language model infrastructure. The goal of the financially motivated campaign, dubbed Canto Incognito, is to deploy cryptocurrency miners on compromised servers and grow a botnet.

Infected machines are loaded with miners including XMRig and Iron, and victims are connected to Kryptex, a Russian cryptocurrency mining service. The hijacked hosts are not just used to mine: some are converted into scanners and exploit servers that go looking for — and compromise — additional vulnerable systems.

A server address buried in verse

The malware itself was codenamed PoeLLM because of an unusual trick: the command-and-control (C2) address is hidden inside a poem the operators wrote and published in a GitHub repository. The first commit dates to April 13, 2026.

"Each time they set up a new C2, they change a few words in the poem, and the malware derives the address from the key associated with those words," said Ryan English, information security engineer at Lumen Technologies.

The main targets are enterprise, internet-exposed deployments such as LiteLLM and Gotenberg, along with Gitea and Ivanti Sentry appliances. The focus on LLM instances is no accident — their compute power is exactly what the attackers want for mining.

Scale and method

The malware has been active since April 2026, with more than 3,400 victim servers identified so far, concentrated in the U.S. and Western Europe. At its mid-June peak the campaign involved almost 2,200 affected servers, with nearly 800 active per day. Recent traffic toward SSH and other login portals suggests experiments with distributed brute-force attacks, though the maturity of that capability remains uncertain.

Some compromised systems are repurposed to scan the internet, sending HTTP POST requests to exposed ports on identified targets that instruct them to download the malware from the C2.

Lumen attributes the activity, with moderate confidence, to an Italian-speaking threat actor, citing Italian-language artifacts and netflow indicators. Exposed AI and LLM services are doubly attractive, the company notes: valuable not only for their software vulnerabilities, but because they may hold useful data and run on powerful hardware well suited to mining.

Source: The Hacker News