A cryptomining botnet does not need a hard-coded C2 address; it only needs four words in a GitHub poem titled On the Nature of Connection. Since April 2026, Lumen Black Lotus Labs has tracked that campaign, dubbed Canto Incognito and the malware PoeLLM, as it compromised more than 3,400 servers running exposed AI and open-source services.
At AG Tech Consulting, we tell clients to inventory every internet-facing LiteLLM, Ollama, Gotenberg and Gitea deployment, pull them off the public net, and patch before the next poem update rotates the C2.
Canto Incognito in brief
Black Lotus Labs first bumped into PoeLLM while investigating an Ivanti Sentry vulnerability, CVE-2026-10520. A compromised Sentry host contacted a dedicated server, then started scanning for more victims.
Most victims run vulnerable internet-facing LiteLLM or Ollama. Hundreds more run Gotenberg, the open-source PDF converter, or Gitea. Peak activity exceeded 800 active servers per day, with the heaviest concentrations in the United States and Western Europe.
The campaign looks financially motivated. Italian-language comments in the sample, netflow to Italy-hosted admin infrastructure, and Kryptex mining endpoints all point to an Italian-speaking operator chasing compute, not espionage.
The poem that hides the C2
The C2 lookup lives in a GitHub repository owned by user ejejejdfbbebe, a fork of the nodejs.org website source that has nothing to do with Node.js itself. Inside a file named dash.css, which does not exist in the original repo, the actor posted a two-stanza poem titled On the Nature of Connection.
That poem has been updated 11 times since the first commit on 13 April 2026. Each edit changes four keywords so infected hosts recompute a new IPv4 C2 address without a malware update.
The malware function extract_poem_phrase_field pulls three words with fixed anchors, case-insensitively: the text between "In the silent hum of " and a comma; between "each pulse of " and " threading"; and between "Beyond the wall of " and a comma.
A fourth extractor at 0x44a8db to 0x44a99b finds the phrase "of distant servers", walks back to the previous whitespace, requires the four bytes before the word to be "the ", and takes the word after "the" as Word 4.
Those four words are looked up in a hard-coded dictionary inside the binary and concatenated into an IPv4 address. In one June sample, driver mapped to 92, diode to 119, decryption to 165 and string to 74, producing 92.119.165.74.
Figure: How PoeLLM turns four words in On the Nature of Connection into a live C2, then mines and scans from the victim. Original diagram by Your CTO Advisor, based on Lumen Black Lotus Labs reporting.
How the bots get in
From May 2026 the operator scanned heavily on ports 3000 and 4000, the common listeners for Gotenberg and LiteLLM. When a vulnerable host answered, an exploit server sent a crafted POST that told it to download a payload from the C2 on port 81.
In the sample Black Lotus Labs analysed, the LiteLLM path abused was /mcp-rest/test/connection, the same endpoint tied to CVE-2026-42271, a command-injection flaw affecting LiteLLM versions 1.74.2 through before 1.83.7. Patch releases start at 1.83.7.
The downloaded ELF masquerades as libgcrypt. It carries remote-shell functionality, XMRig and Iron cryptominers, HTTP and HTTPS scanners, and exploit staging so each new victim can hunt the next one.
Infected hosts beacon back on C2 ports such as 3778, 5001, 5002 or 9999, and many also talk to Kryptex mining infrastructure. Compromised routers with exposed Boa admin pages repeatedly show up as C2 hosts, so the actor is recycling vulnerable edge gear rather than renting clean servers.
The future security risk
Over the next two to five years, the attractive target will not be a lonely WordPress box. It will be an internet-facing AI gateway, local model server or document pipeline sitting on GPU hardware with API keys in memory.
Expect more living-off-GitHub C2 patterns: poems, READMEs, CSS comments and issue threads that look harmless to a human reviewer but decode cleanly for a hard-coded dictionary in the implant.
The same class of exposure keeps widening. On 8 October 2026, CERT Polska published CVE-2026-103663 against Ollama: path traversal in /api/pull via digestToPath, fixed in 0.35.0, which can plant a binary outside the model store and, on Docker images with write access to /usr/lib/ollama, execute as root after restart.
Mining is the easy cash-out. The harder future risk is LLM jacking, credential theft from the proxy, and using your own AI stack as a quiet scanner and exploit server against the rest of your fleet.
A five-point checklist for exposed AI services
Inventory every LiteLLM, Ollama, Gotenberg, Gitea and similar AI or open-source service that answers on the public internet, especially on ports 3000 and 4000. Pull non-essential instances off the public net; put required ones behind auth, allowlists and a reverse proxy, and never expose admin or MCP test endpoints. Patch LiteLLM to 1.83.7 or later for CVE-2026-42271, Ollama to 0.35.0 or later for CVE-2026-103663, and apply current Ivanti Sentry fixes for CVE-2026-10520 where relevant. Hunt for the libgcrypt-named ELF, XMRig or Iron miners, Kryptex pool traffic, and outbound beacons to the C2 IPs published by Black Lotus Labs. Treat GitHub, package registries and CSS-looking decoy files as potential C2 channels: alert on unexpected fetches of dash.css-style paths and on processes that parse poem-like text into IPs.
The skeptical note
A poem-based C2 is clever, not magical. Once defenders know the anchors and the dictionary, every new stanza is a free IOC, and Black Lotus Labs says it has already blocked traffic to the known PoeLLM C2 set for Lumen Defender customers.
Attribution to an Italian-speaking financially motivated actor rests on language in the sample, Italy-geolocated admin hosts and Kryptex economics. That is a solid working assessment, not courtroom proof, and language packs are easy to fake.
Victim counts also shift with telemetry windows. Help Net Security and The Register both round the campaign past 3,000 servers; Black Lotus Labs’ detailed post puts the observed impact above 3,400, with earlier peaks near 2,200 concurrent affected hosts.
Treat PoeLLM as a warning about internet-facing AI tooling, not as evidence that every local LLM is doomed. The fix is still the boring one: inventory, exposure control, patching and egress monitoring.
Sources
Lumen Black Lotus Labs, “Canto incognito: tracking the PoeLLM malware”: https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware
Help Net Security, “Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers”: https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/
The Register, “Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers”: https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers/5301672
CyberScoop, “PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem”: https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/
CERT Polska, CVE-2026-103663 (Ollama path traversal in /api/pull): https://cert.pl/en/posts/2026/10/CVE-2026-103663/
Cloud Security Alliance research note, LiteLLM CVE-2026-42271: https://labs.cloudsecurityalliance.org/research/csa-research-note-litellm-cve-2026-42271-ai-gateway-exploita/
Originally published on LinkedIn in the Your CTO Advisor newsletter: read and comment on LinkedIn →
