# PoeLLM (Canto Incognito) malware infects exposed AI servers (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry) in cryptomining attacks - CVE-2026-42271, CVE-2026-48710

> Lumen's Black Lotus Labs reports PoeLLM, an ELF malware (named libgcrypt) that compromises exposed AI and other internet-facing servers and deploys XMRig and Iron miners tied to the Kryptex pool. More than 3,400 servers were compromised since April 2026, peaking at about 800 active daily infections, mostly in the United States and Western Europe. The C2 IPv4 address is derived from words in a poem hosted in a GitHub repository.

- **Published:** 2026-10-07T00:00:00Z
- **Last reviewed:** 2026-10-10T04:21:49.934Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3010
- **ID:** TL-2026-3010
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42271, CVE-2026-48710, CVE-2026-10520, CVE-2018-21027, CVE-2018-21028

## Description

PoeLLM is a Linux ELF botnet/cryptominer dropper (file name libgcrypt) tracked by Lumen's Black Lotus Labs under the campaign name Canto Incognito. Activity began on 2026-04-13 (first commit to the attacker's GitHub repository, with the first C2 in Brazil) and has compromised more than 3,400 servers, peaking in mid-June 2026 at roughly 2,200 affected servers and about 800 active infections per day. Victims are concentrated in the United States and Western Europe. Black Lotus Labs first encountered the activity in June 2026 while investigating exploitation of the maximum-severity Ivanti Sentry flaw.

Initial access is by internet-wide scanning of ports 3000 (Gotenberg) and 4000 (LiteLLM) followed by crafted POST requests. The malware targets exposed LiteLLM, Ollama, Gotenberg and Gitea services and Ivanti Sentry appliances. For LiteLLM the key flaw is CVE-2026-42271: the POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list endpoints accept a full MCP stdio server configuration (command, args, env) and spawn it as a subprocess on the proxy host. In LiteLLM 1.74.2 through 1.83.6 these endpoints require only a valid proxy API key with no role check. Horizon3.ai showed it chains with Starlette CVE-2026-48710 (Host header validation bypass, Starlette <= 1.0.0) to give unauthenticated RCE; CISA added CVE-2026-42271 to KEV on 2026-06-08. Lumen also lists Ivanti Sentry CVE-2026-10520 (unauthenticated OS command injection, root RCE; fixed in R10.5.2, R10.6.2, R10.7.1) in the reconnaissance phase, and Boa web server router flaws CVE-2018-21027 and CVE-2018-21028. Public reporting does not give CVE numbers for the Ollama, Gotenberg and Gitea targeting. Exact CVSS scores differ between sources, so cvss_score is left null.

The exploit payload is fetched from the C2 on port 81. Infected hosts then beacon to the C2 on ports 3778, 5001, 5002 or 9999. The malware provides a remote shell, HTTP/HTTPS scanning and exploit deployment, installs XMRig and Iron miners, and connects victims to the Russian Kryptex mining service. Infected servers are reused as scanners and exploit servers to grow the botnet. SSH brute-force experimentation was seen between July and September.

The C2 resolution is novel. The malware fetches dash.css from a GitHub repository (user ejejejdfbbebe, a fork of the nodejs.org site source) containing the poem 'On the Nature of Connection'. It pulls four words from fixed phrase anchors, maps each through a hard-coded dictionary to a number, and joins them into an IPv4 address (for example driver=92, diode=119, decryption=165, string=74 gives 92.119.165.74). The poem has been edited 11 times since April, so C2 moves without recompiling the malware, and it contains no links or files that would trigger alerts. Infrastructure relies on compromised home and office routers rather than rented servers. At least 11 C2 servers are documented, hosted in Brazil, China and elsewhere.

Black Lotus Labs attributes the activity with moderate confidence to an Italian-speaking operator, based on Italian-language code comments, an Italy-hosted administrative host (185.119.19.171) running monitoring dashboards, an Italy-linked domain (malwarescan.xyz, registered February 2026) and netflow indicators. Motivation is financial. Reporting also notes potential for credential theft and token abuse on compromised AI servers, with GPU-equipped AI hosts as attractive mining targets.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1584.008 Network Devices
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1110 Brute Force
- T1036 Masquerading
- T1102.001 Dead Drop Resolver
- T1568 Dynamic Resolution
- T1571 Non-Standard Port
- T1496.001 Compute Hijacking
- T1105 Ingress Tool Transfer
- T1071.001 Application Layer Protocol
- T1584.005 Compromise Infrastructure
- T1046 Network Service Discovery
- T1583.001 Acquire Infrastructure
- T1608.001 Stage Capabilities

## Sources

- [PoeLLM malware infects exposed AI servers in cryptomining attacks](https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/)
- [Canto Incognito: Tracking the PoeLLM malware (Lumen Black Lotus Labs)](https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware)
- [PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet](https://thehackernews.com/2026/10/poellm-malware-infects-3400-servers-to.html)
- [Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers](https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers/5301672)
- [PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem](https://cyberscoop.com/poellm-malware-botnet-poem-lumen-black-lotus-labs/)
- [PoeLLM turns exposed AI and developer servers into miners and attack launchpads](https://runtimewire.com/article/poellm-exposed-ai-servers-cryptomining-botnet)
- [Lumen Black Lotus Labs: Attacker running malware with a poem](https://itnerd.blog/2026/10/07/lumen-black-lotus-labs-attacker-running-malware-with-a-poem/)
- [LiteLLM CVE-2026-42271: MCP stdio test RCE, CISA KEV](https://lilting.ch/en/articles/litellm-cve-2026-42271-cisa-kev)
- [Horizon3.ai: LiteLLM CVE-2026-42271 + Starlette CVE-2026-48710 unauthenticated RCE chain](https://aicsr.georgelambert.org/output/references/articles/horizon3-chain.md)
- [CVE-2026-10520 Exploited: Ivanti Sentry Gateways Compromised Shortly After Patch Release](https://securityaffairs.com/193530/hacking/cve-2026-10520-exploited-ivanti-sentry-gateways-compromised-shortly-after-patch-release.html)
- [CISA gives feds 3 days to patch Ivanti flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/cisa-gives-feds-3-days-to-patch-ivanti-flaw-exploited-in-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3010