PoeLLM Cryptomining Malware Infects More Than 3,400 Servers

The PoeLLM cryptocurrency mining malware has infected more than 3,400 servers in the Canto Incognito campaign, which has been tracked since April 2026. The attack has primarily targeted vulnerable versions of open-source artificial intelligence services such as LiteLLM and Ollama. The campaign is still spreading to new servers. The attack is believed to be financially motivated.

The malware hides the address of its command-and-control server in the 2-stanza poem “On the Nature of Connection,” published on GitHub. The malware selects 4 specific words from the poem, converts them into numbers and determines a new IPv4 address. Although the poem has been changed 11 times so far, the rule used to determine the address has remained the same. This redirects infected servers to new C2 servers. A C2 server is a server attackers use to send commands to and control malware.

LiteLLM, one of the main targets, is software that provides a unified interface to various language models. Gotenberg is a Docker-based API for converting PDF files, meaning it makes it easier for other programs to communicate with it. Ollama runs open models on private hardware, while Gitea is a Git platform installed on a server. An enterprise network gateway called Ivanti Sentry is also thought to have been targeted. Leaving these services exposed to the internet increased the risk of attack.

The attack may have exploited the CVE-2026-42271 vulnerability in LiteLLM. This vulnerability allows commands to be executed on the server without checking the user’s role. The attack is believed to have begun when a specially crafted POST request was sent to an endpoint in the system. The package uploaded to the server contains the XMRig and Iron cryptominers. They communicate with the Kryptex mining infrastructure. Infected devices then become attack servers that search for other systems and exploit their vulnerabilities.

All of the first 900 victims communicated with an endpoint used for Russia’s cryptocurrency mining service. This detail reinforces the belief that the attack was financially motivated. The poem was used only to hide the C2 address. The incident is not related to sending malicious requests to artificial intelligence or to prompt injection, an attempt to mislead artificial intelligence with specific commands.

When the report was released, 3 of the 12 C2 servers were still active. Traffic to and from the identified addresses had been blocked. System owners are advised to check internet-exposed services, close unnecessary ports and examine connection logs. LiteLLM version 1.83.7 or later should be installed. Ivanti Sentry should be upgraded to version R10.5.2 or R10.6.2. Another option is version R10.7.1.