PoeLLM Malware Hijacks 3,400+ AI Servers for Crypto Mining — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PoeLLM malware has compromised more than 3,400 internet-facing servers since April 2026, with infections concentrated in the U.S. and Western Europe, according to Lumen Black Lotus Labs.
- The campaign, dubbed Canto Incognito, primarily targets AI/LLM deployments such as LiteLLM and Gotenberg, alongside Gitea and Ivanti Sentry appliances, exploiting their compute power to run XMRig and Iron miners through Russian service Kryptex.
- The C2 address is concealed inside a poem the threat actors wrote and hosted in a GitHub repository (github[.]com/ejejejdfbbebe), with the first commit dated April 13, 2026, and each new server changing a few words to derive a new address.
- Compromised hosts are reused as scanners and exploit servers, sending HTTP POST requests to exposed ports on identified targets to spread the malware and grow the botnet, Lumen researchers said.
- At peak operations in mid-June, the campaign involved nearly 2,200 affected servers with about 800 active per day, and more recent traffic toward SSH and login portals suggests the operators are experimenting with distributed brute-force attacks.
- Lumen Black Lotus Labs attributed the activity to an Italian-speaking threat actor with moderate confidence, based on Italian-language artifacts and netflow indicators found in the campaign infrastructure.
Why it matters: With 3,400 enterprise servers already enlisted and AI infrastructure now a deliberate target, organizations running exposed LLM, document, and IT-service appliances face both compute theft and the risk of being conscripted as attack infrastructure — the infected hosts actively scan the internet for new victims, turning each compromise into a propagation node.
Ask SkimNews
