PoeLLM Turns a Poem on GitHub Into a Command Server - and 3,400 Exposed AI Servers Into a Mining Botnet

Most malware hides its command server behind domain-generation algorithms or proxy chains. PoeLLM hides it in a poem. Lumen's Black Lotus Labs says a campaign it tracks as Canto Incognito has infected more than 3,400 victim servers since April 2026, peaking in mid-June at nearly 2,200 affected machines and roughly 800 active per day. The malware takes its name from the mechanism that keeps it alive.

The mechanism is a GitHub repository - a fork of the Node.js website source code - containing a file called dash.css that does not exist in the original project. Inside it sits a two-stanza poem titled "On the Nature of Connection," first committed on April 13, 2026 and since edited 11 times. PoeLLM's payload carries custom logic that extracts four specific words or phrases from the poem, converts them through a hard-coded dictionary into numbers, and reassembles those numbers into the IPv4 address of the current command-and-control server. Editing a few words repoints every infected machine at a new server.

The appeal of poetry is that it looks harmless. There are no links, no attachments and no obviously malicious content, which makes the repository hard for security tooling and researchers to flag. Lumen told The Register a poem is "a perfect vehicle for hiding an important message." The researchers are also careful about scope: this is an encoding trick for server addresses, not an AI jailbreak or prompt injection, and not the "adversarial poetry" technique described in academic work last year.

Once inside, PoeLLM deploys a remote shell, XMRig and Iron cryptocurrency miners connected to Kryptex mining infrastructure, and converts infected machines into scanners and exploitation servers that hunt for more targets. A shared endpoint belonging to Kryptex, a Russian crypto mining service, was the main commonality among the first 900 victims - one reason Lumen assesses the operation is financially motivated rather than espionage-driven.

The entry point is exposed AI infrastructure. Most victims were running vulnerable, internet-facing versions of open-source AI and LLM services - LiteLLM, a proxy that routes applications to multiple model APIs, and Ollama, which runs open-weight models on local hardware - alongside Gotenberg, a Docker-based PDF conversion API, and the self-hosted Git platform Gitea. Ivanti Sentry appliances may also have been targeted. For LiteLLM, Lumen believes the way in was a crafted POST to the /mcp-rest/test/connection endpoint, tied to the command-injection flaw CVE-2026-42271 (CVSS 8.7), which CISA added to its Known Exploited Vulnerabilities catalog in June. Horizon3.ai chained that bug with a Starlette host-header bypass, CVE-2026-48710, into a remote-code-execution chain scored at 10.0. An earlier LiteLLM SQL injection issue, CVE-2026-42208, was exploited within 36 hours of becoming public.

The awkward part is that a fix already existed. LiteLLM shipped a patch in April that likely closed the exploitation path, and current guidance is to run version 1.83.7 or later; Ivanti Sentry operators should be on R10.5.2, R10.6.2 or R10.7.1. Most victims were still on vulnerable versions when hit, and Gotenberg's own documentation warns operators not to expose the service to the internet in the first place.

When Lumen published its report, three of the twelve known C2 servers were still live and the campaign "continues to infect new victims." The company says it has blocked traffic to and from the C2 infrastructure and will keep monitoring. Its closing warning is the broader point: enterprise attack surfaces are "expanding rapidly as AI infrastructure grows" - and every exposed inference endpoint is now a target that offers valuable data on one side and rentable GPUs on the other.