Artificial Intelligence · Cybersecurity
PoeLLM malware targeted AI servers for crypto mining
Lumen Black Lotus Labs said a malware family called PoeLLM had targeted exposed AI and large language model systems, deployed miners and scanners, and affected more than 3,400 servers.
- Lumen Black Lotus Labs said PoeLLM targeted exposed AI and large language model infrastructure to install cryptocurrency miners and expand a botnet.
- The campaign installed XMRig and Iron and connected victims to Kryptex.
- Lumen said the attacks mainly hit internet-facing deployments such as LiteLLM, Gotenberg, Gitea and Ivanti Sentry.
- Lumen said the malware had been active since April 2026 and that more than 3,400 victim servers had been identified.
- Ryan English said the malware hid its command-and-control address in a poem stored in a GitHub repository first committed on 13 April 2026.
Lumen Black Lotus Labs said a malware family called PoeLLM had targeted exposed AI and large language model systems. It said the aim was to deploy cryptocurrency miners and widen the botnet.
The campaign was also described as Canto Incognito. Lumen said infected hosts were turned into scanners and exploit servers, and that the code installed XMRig and Iron while linking victims to Kryptex.
Ryan English of Lumen Technologies said the malware concealed its control address in a poem hosted in a GitHub repository. He said the operators changed a few words in the poem when they set up a new control server, and that the first commit was made on 13 April 2026.
Lumen said the activity had been underway since April 2026 and that it had identified more than 3,400 affected servers. It said the infections were concentrated in the United States and Western Europe, and that it had moderate confidence that an Italian-speaking actor was responsible.
Named in this story
People
- Ryan English
- described how the malware derived its control address
Companies
- Lumen Technologies
- was Ryan English’s employer
- Kryptex
- the mining service the victims were connected to
Organisations
- Lumen Black Lotus Labs
- reported and analysed the campaign
Products and systems
- PoeLLM
- the malware family used in the attacks
- Canto Incognito
- the name given to the campaign
- XMRig
- one cryptocurrency miner installed on infected hosts
- Iron
- another cryptocurrency miner installed on infected hosts
- LiteLLM
- one of the targeted internet-facing deployments
- Gotenberg
- one of the targeted internet-facing deployments
- Gitea
- one of the targeted internet-facing deployments
- Ivanti Sentry
- one of the targeted appliances
Places
- United States
- one of the main regions where infections were found
- Western Europe
- another main region where infections were found
How the source tells it
The source was mostly matter-of-fact, with slight novelty and scale framing around a newly named malware family and the size of the victim set.
- novelty the piece introduced a newly named malware family and an unusual control-address hiding method
- urgency it relied on victim totals, peak counts and an active-since date to convey scale