PoeLLM cryptomining malware infects 3,400 exposed AI and web servers through known vulnerabilities

Lumen Black Lotus Labs detailed PoeLLM, the malware behind the financially motivated Canto Incognito campaign, which has infected more than 3,400 internet-facing servers since April 2026. The actor hides its command-and-control address inside a poem stored in a GitHub repository, changing a few words whenever it rotates infrastructure. It exploits known vulnerabilities in exposed services such as LiteLLM, Gotenberg, Gitea, and Ivanti Sentry, then installs XMRig and Iron miners to abuse victim compute for cryptocurrency mining through a Russian mining service. Compromised hosts become scanners and exploit servers that spread the malware further, and recent traffic suggests experimentation with distributed brute-force attacks.

Check

Patch known vulnerabilities in internet-facing LiteLLM, Gotenberg, Gitea, and Ivanti Sentry deployments, and inspect servers for XMRig or Iron miner processes and unexpected outbound scanning.

Affected

Exposed servers running vulnerable LiteLLM, Gotenberg, Gitea, or Ivanti Sentry can be infected by PoeLLM, turned into cryptominers, and reused to scan and infect further hosts.

Fix

Apply available patches to exposed services, remove miner payloads and attacker accounts, restrict inbound access to management and AI services, and monitor for outbound exploit scanning.