A financially motivated cryptomining campaign, dubbed Canto Incognito, has compromised over 3,400 servers, primarily in the U.S. and Western Europe, by exploiting vulnerabilities in exposed AI and large language model (LLM) infrastructure. The campaign utilizes malware, codenamed PoeLLM, to turn compromised servers into scanners and launchpads for further infections. Lumen Black Lotus Labs identified the activity as beginning in April 2026, with a peak of nearly 2,200 affected servers in mid-June. The malware installs cryptocurrency miners, including XMRig and Iron, and connects victims to Kryptex, a Russian cryptocurrency mining service.
The PoeLLM malware employs a unique technique to conceal its command-and-control (C2) address, hiding it within a poem hosted on GitHub. According to Ryan English, information security engineer at Lumen Technologies, the threat actors modify the poem to change the C2 address each time a new server is set up, deriving the address from keywords within the altered text. Targeted services include enterprise deployments of LiteLLM and Gotenberg, as well as Gitea and Ivanti Sentry appliances. Compromised servers are repurposed to scan for similar vulnerable systems, sending HTTP POST requests to download the malware.
Lumen Black Lotus Labs attributes the campaign to an Italian-speaking threat actor with moderate confidence, based on Italian-language artifacts and network traffic indicators. Recent activity suggests experimentation with distributed brute-force attacks, though the maturity of this capability remains uncertain. The campaign’s focus on AI infrastructure highlights the increasing attractiveness of these services as targets, not only due to software vulnerabilities but also because of their substantial compute power.
Read the original coverage
💬 Comments
📜 Comment Policy