Threat reportMalwareTL-2026-3010
PoeLLM (Canto Incognito) malware infects exposed AI servers (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry) in cryptomining attacks - CVE-2026-42271, CVE-2026-48710
PoeLLM (Canto Incognito) malware infects exposed AI servers (TL-2026-3010), also tracked as PoeLLM, is a high-severity malware campaign, first published 2026-10-07 and last reviewed 2026-10-10. It has no confirmed attribution, affects BerriAI LiteLLM, references 5 CVEs (CVE-2026-42271, CVE-2026-48710, CVE-2026-10520), maps to 16 MITRE ATT&CK techniques (T1036, T1046, T1059.004), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-3010
- Threat ID
- TL-2026-3010
- Also known as
- PoeLLM, Canto Incognito
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, infrastructure, software-development, enterprise
- Target regions
- united states of america, 155 - Western Europe
- Detection rules
- 9
- Indicators of compromise
- 31
- Updates
- 2026-10-10 · 3 updates · revalidated 3× · latest source
Malware and tooling in PoeLLM (Canto Incognito) malware infects exposed AI servers
Malware and tooling: PoeLLM, xmrig, Iron, XMRig
How PoeLLM (Canto Incognito) malware infects exposed AI servers works
Lumen's Black Lotus Labs reports PoeLLM, an ELF malware (named libgcrypt) that compromises exposed AI and other internet-facing servers and deploys XMRig and Iron miners tied to the Kryptex pool. More than 3,400 servers were compromised since April 2026, peaking at about 800 active daily infections, mostly in the United States and Western Europe. The C2 IPv4 address is derived from words in a poem hosted in a GitHub repository.
PoeLLM is a Linux ELF botnet/cryptominer dropper (file name libgcrypt) tracked by Lumen's Black Lotus Labs under the campaign name Canto Incognito. Activity began on 2026-04-13 (first commit to the attacker's GitHub repository, with the first C2 in Brazil) and has compromised more than 3,400 servers, peaking in mid-June 2026 at roughly 2,200 affected servers and about 800 active infections per day. Victims are concentrated in the United States and Western Europe. Black Lotus Labs first encountered the activity in June 2026 while investigating exploitation of the maximum-severity Ivanti Sentry flaw.
Initial access is by internet-wide scanning of ports 3000 (Gotenberg) and 4000 (LiteLLM) followed by crafted POST requests. The malware targets exposed LiteLLM, Ollama, Gotenberg and Gitea services and Ivanti Sentry appliances. For LiteLLM the key flaw is CVE-2026-42271: the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints accept a full MCP stdio server configuration (command, args, env) and spawn it as a subprocess on the proxy host. In LiteLLM 1.74.2 through 1.83.6 these endpoints require only a valid proxy API key with no role check. Horizon3.ai showed it chains with Starlette CVE-2026-48710 (Host header validation bypass, Starlette <= 1.0.0) to give unauthenticated RCE; CISA added CVE-2026-42271 to KEV on 2026-06-08. Lumen also lists Ivanti Sentry CVE-2026-10520 (unauthenticated OS command injection, root RCE; fixed in R10.5.2, R10.6.2, R10.7.1) in the reconnaissance phase, and Boa web server router flaws CVE-2018-21027 and CVE-2018-21028. Public reporting does not give CVE numbers for the Ollama, Gotenberg and Gitea targeting. Exact CVSS scores differ between sources, so cvss_score is left null.
The exploit payload is fetched from the C2 on port 81. Infected hosts then beacon to the C2 on ports 3778, 5001, 5002 or 9999. The malware provides a remote shell, HTTP/HTTPS scanning and exploit deployment, installs XMRig and Iron miners, and connects victims to the Russian Kryptex mining service. Infected servers are reused as scanners and exploit servers to grow the botnet. SSH brute-force experimentation was seen between July and September.
The C2 resolution is novel. The malware fetches dash.css from a GitHub repository (user ejejejdfbbebe, a fork of the nodejs.org site source) containing the poem 'On the Nature of Connection'. It pulls four words from fixed phrase anchors, maps each through a hard-coded dictionary to a number, and joins them into an IPv4 address (for example driver=92, diode=119, decryption=165, string=74 gives 92.119.165.74). The poem has been edited 11 times since April, so C2 moves without recompiling the malware, and it contains no links or files that would trigger alerts. Infrastructure relies on compromised home and office routers rather than rented servers. At least 11 C2 servers are documented, hosted in Brazil, China and elsewhere.
Black Lotus Labs attributes the activity with moderate confidence to an Italian-speaking operator, based on Italian-language code comments, an Italy-hosted administrative host (185.119.19.171) running monitoring dashboards, an Italy-linked domain (malwarescan.xyz, registered February 2026) and netflow indicators. Motivation is financial. Reporting also notes potential for credential theft and token abuse on compromised AI servers, with GPU-equipped AI hosts as attractive mining targets.
MITRE ATT&CK techniques used in TL-2026-3010
Defense Evasion
Discovery
T1046 Network Service Discovery
Execution
Command and Control
T1071.001 Application Layer Protocol; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1568 Dynamic Resolution; T1571 Non-Standard Port
Credential Access
Initial Access
T1190 Exploit Public-Facing Application
Impact
Resource Development
T1583.001 Acquire Infrastructure; T1584.005 Compromise Infrastructure; T1584.008 Network Devices; T1608.001 Stage Capabilities
Reconnaissance
Affected products and versions in PoeLLM (Canto Incognito) malware infects exposed AI servers
- BerriAI — LiteLLM
Vulnerable versions: 1.74.2 through 1.83.6
Fixed in: 1.83.7 - Encode — Starlette
Vulnerable versions: <= 1.0.0
Fixed in: 1.0.1 - Ivanti — Sentry
Vulnerable versions: before R10.5.2; before R10.6.2; before R10.7.1
Fixed in: R10.5.2; R10.6.2; R10.7.1 - Ollama — Ollama
Vulnerable versions: exposed instances (no CVE stated in sources) - Gotenberg — Gotenberg
Vulnerable versions: exposed instances on port 3000 (no CVE stated in sources) - Gitea — Gitea
Vulnerable versions: exposed instances (no CVE stated in sources) - Boa — Boa Web Server (embedded router admin interfaces)
Vulnerable versions: CVE-2018-21027 and CVE-2018-21028 affected builds
Remediation for PoeLLM (Canto Incognito) malware infects exposed AI servers
Patches
- Upgrade LiteLLM to 1.83.7 or later
- Upgrade Starlette to 1.0.1 or later
- Apply Ivanti Sentry fixes R10.5.2, R10.6.2 or R10.7.1 for CVE-2026-10520
- Apply the latest security updates for Ollama, Gotenberg and Gitea
Immediate actions
- Block and hunt for the C2 IPs, Kryptex pool endpoints and malwarescan.xyz listed in the IOCs
- Block access to /mcp-rest/test/connection and /mcp-rest/test/tools/list on LiteLLM proxies at the reverse proxy
- Search hosts for an ELF named libgcrypt running outside system library paths and for unexpected XMRig or Iron miner processes
- Review web logs for malformed Host headers and subprocess spawning from LiteLLM
- Rotate API keys, tokens and credentials stored on any exposed LiteLLM, Ollama, Gotenberg or Gitea host
Workarounds
- Take administrative and MCP test interfaces offline or place them behind VPN/IP allowlists
- Disable stdio MCP server creation for non-admin keys until patched
Longer-term hardening
- Reduce public internet exposure of AI and developer services; restrict access to trusted IPs only
- Inventory internet-facing AI infrastructure (ports 3000 and 4000) and apply egress filtering
- Alert on outbound mining-pool connections and on GitHub raw-content fetches from servers
CVEs associated with PoeLLM (Canto Incognito) malware infects exposed AI servers
CVE-2026-42271, CVE-2026-48710, CVE-2026-10520, CVE-2018-21027, CVE-2018-21028
Weaknesses (CWE) in PoeLLM (Canto Incognito) malware infects exposed AI servers
Timeline of PoeLLM (Canto Incognito) malware infects exposed AI servers
- Domain malwarescan.xyz (hosted on Italy-based 57.131.5.211, an early contact server) is registered in February 2026 ahead of the campaign.
- First commit to the attacker's GitHub repository (user ejejejdfbbebe, nodejs.org fork hiding the poem in dash.css); testing phase begins with a Brazil-based C2 (191.37.28.160).
- LiteLLM CVE-2026-42271 (MCP stdio test endpoint command execution) disclosed.
- LiteLLM adds authorization controls for the MCP test endpoints; fixed release is 1.83.7.
- Starlette CVE-2026-48710 (Host header validation bypass) publicly disclosed.
- Horizon3.ai confirms CVE-2026-42271 chains with CVE-2026-48710 for unauthenticated RCE against LiteLLM.
- CISA adds CVE-2026-42271 to the Known Exploited Vulnerabilities catalog (federal due date 2026-06-22).
- Shadowserver reports Ivanti Sentry CVE-2026-10520 exploited and gateways backdoored; Black Lotus Labs encounters PoeLLM while investigating this activity.
- CISA adds Ivanti Sentry CVE-2026-10520 to the Known Exploited Vulnerabilities catalog; PoeLLM also observed probing Ivanti Sentry in June.
- Mid-June peak of roughly 2,200 affected servers and about 800 active daily infections; C2 178.128.14.204 first seen.
- Poem version decoding to C2 92.119.165.74 (driver=92, diode=119, decryption=165, string=74) is the worked example in Lumen's analysis.
- C2 92.119.164.50 first seen; earlier C2 92.119.165.74 retired the same day as the poem is edited again.
- C2 103.249.201.108 first seen; the poem has been edited 11 times in total through September.
- C2 136.148.69.233 (active since 2026-09-12) goes inactive.
- The attacker's GitHub repository (ejejejdfbbebe) is taken offline following Lumen's report; Lumen says this completely disrupted the campaign's C2 resolution.
- Lumen Black Lotus Labs publishes 'Canto Incognito: Tracking the PoeLLM malware'; reporting states 3,400+ servers compromised.
Update history for TL-2026-3010
- 2026-10-10 — PoeLLM Malware Uses GitHub-Hosted Poem for C2 Address Resolution, Targeting AI Infrastructure (CVE-2026-42271 LiteLLM): What changed No change to severity, exploitability, status or attribution. Existing values (HIGH / ACTIVE / ACTIVE / MEDIUM) are unchanged. The update only adds supporting detail. New indicators (1) 1 new behavioral indicator: outbound scan
- 2026-10-10 — PoeLLM cryptomining botnet (Canto Incognito) hides C2 addresses in GitHub poem, infects 3,400+ servers; exploits CVE-2026-42271 (LiteLLM) and CVE-2026-10520 (Ivanti Sentry): What changed No severity, exploitability or status change applied. The report states the GitHub dead-drop repository was taken offline, which Lumen says disrupted the campaign. Status is left ACTIVE because the update cannot downgrade field
- 2026-10-07 — PoeLLM malware infects 3,400+ servers via LiteLLM, Gotenberg, Gitea and Ivanti Sentry to expand crypto mining botnet (Canto Incognito campaign; CVE-2026-42271, CVE-2026-10520): What changed No severity, exploitability or status change; the record is enriched, not escalated. New indicators (4) 2 payload staging URLs on C2 5.78.73.122:81 (bins.sh, python3.6), the LiteLLM exploit request path, and the C2 port set. Ne
Sources cited for PoeLLM (Canto Incognito) malware infects exposed AI servers
- PoeLLM malware infects exposed AI servers in cryptomining attacks
- Canto Incognito: Tracking the PoeLLM malware (Lumen Black Lotus Labs)
- PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
- Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers
- PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
- PoeLLM turns exposed AI and developer servers into miners and attack launchpads
- Lumen Black Lotus Labs: Attacker running malware with a poem
- LiteLLM CVE-2026-42271: MCP stdio test RCE, CISA KEV
- Horizon3.ai: LiteLLM CVE-2026-42271 + Starlette CVE-2026-48710 unauthenticated RCE chain
- CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch Release
- CISA gives feds 3 days to patch Ivanti flaw exploited in attacks
Detection coverage for TL-2026-3010
As of 2026-10-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3010 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.