Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

Black Lotus Labs has uncovered a cryptomining botnet called PoeLLM that retrieves its command-and-control address from a poem hidden in a GitHub repository, with each of the poem's words decoded into numbers that form the C2's IPv4 address. Tracked under the name Canto Incognito and attributed to a likely Italian-speaking, financially motivated actor active since April 2026, the campaign has compromised more than 3,400 servers, mostly in the US and Western Europe, by exploiting exposed instances of LiteLLM, Ollama, Gotenberg and Gitea, as well as Ivanti Sentry (CVE-2026-10520). Researchers first spotted the malware while investigating that Ivanti flaw, and later linked infections to a command-injection bug in LiteLLM tracked as CVE-2026-42271. Once a device is breached, PoeLLM deploys XMRig and Iron miners tied to the Kryptex pool, while also offering remote-shell access and scanning/exploitation tools that let infected machines hunt for new victims; the operator has reportedly begun testing SSH brute-forcing as well, and Black Lotus Labs says it is now blocking traffic to the botnet's infrastructure.