PoeLLM Malware: A GitHub Poem Controlled 3,400 AI Servers

👁 113 reads

Black Lotus Labs, part of Lumen, described a campaign it has tracked since April 2026 under the name Canto Incognito. The PoeLLM malware reached more than 3,400 servers, mostly machines running vulnerable versions of open-source services for working with language models - especially LiteLLM and Ollama. The malware was not designed to steal data or extort victims. Its purpose was to mine cryptocurrency on someone else’s hardware.

The operation’s most striking feature was how infected machines learned where to find their command server. The attacker posted a two-stanza poem, titled On the Nature of Connection, on GitHub. Four specific words in the text encoded an IPv4 address. When the attacker needed to move the infrastructure to a new machine, they changed those words and pushed a new commit - 11 times so far. The malware downloaded the file, extracted the relevant words and assembled the address. Researchers noted that the decoding scheme never changed, which meant they could predict future moves once they had worked it out.

This wasn’t an attack on an AI model - it was an attack on the server running it

It’s worth distinguishing this campaign from the much-discussed “adversarial poetry” techniques that try to bypass language-model safeguards by dressing harmful requests up as verse. Here, the poem was never sent to a model, and no one was injecting anything into a prompt. It was simply a way to publish an address - chosen because a literary text on GitHub looks innocuous and does not trigger heuristics. As Lumen researchers told The Register, poetry is

“an ideal vehicle for hiding an important message”

- Black Lotus Labs, quoted by The Register

The initial access method was much more ordinary. For LiteLLM - a popular proxy that lets companies route application traffic to multiple model providers from one place - the likely exploit path involved a crafted POST request to a connection endpoint. The vulnerability allowed two endpoints to execute submitted commands on the host without checking permissions. It was assigned CVE-2026-42271 and added in June to the US CISA catalogue of vulnerabilities known to be exploited in attacks. A patch had already been released in April, meaning most victims had left an internet-facing service unupdated for months.

The targets also included three services administrators may treat as supporting tools and therefore overlook: Gotenberg, a Docker-based API for converting documents to PDF whose documentation explicitly warns against exposing it to the public internet; Gitea, a self-hosted Git platform; and Ollama, which is not exposed externally by default, but whose users often deliberately change its listening address to 0.0.0.0 to reach a model from a laptop or phone. Researchers also mentioned Ivanti Sentry - one infected instance of that appliance led them to the campaign.

What a month of stolen electricity can cost for one GPU

The payload consisted of XMRig and Iron, standard mining software connected to the Kryptex mining pool infrastructure. The first 900 victims had one thing in common: they had contacted an endpoint belonging to a Russian cryptocurrency-mining service. The motive was financial, and it can be measured - but you have to look at both sides of the equation.

Consider a typical self-hosted LLM setup: one RTX 4090 in a workstation, plus a processor with a dozen or so threads. XMRig mines Monero mainly on the CPU, while Iron can load the GPU. A compromised machine running continuously at full load draws about 500-550 W from the wall, compared with about 80 W when idle and waiting for a model request. That 450 W difference adds up to 324 kWh over 720 hours a month. At an electricity rate of about $0.29 per kWh - an approximate conversion of the small-business rate used in the original calculation - that means an extra electricity bill of about $94 a month for one infected machine. Over a year, that is more than $1,130.

For the attacker, the same effort looks very different. Monero mining on a consumer processor with a dozen or so threads delivers roughly 10-15 kH/s. At the current Monero network hashrate and a coin price of around $300, that works out to about $2-3 a month per machine. The imbalance is stark: the hardware owner pays more than 30 times what the attacker earns. But across 3,400 machines, that small amount adds up to roughly $9,000 a month in revenue with no operating costs - while victims collectively face an electricity bill of about $317,000 a month, assuming a significant share of infected hosts are machines with powerful GPUs rather than small VPS instances. These figures are approximate conversions from the original calculation. That is why AI infrastructure has become an attractive target: few other environments concentrate so many expensive GPUs, always-on power supplies and administrators who treat them as a “test environment.”

What to do tonight if you host a model yourself

Here are some concrete steps if you run your own instance. First, check whether Ollama is listening on 0.0.0.0. If the OLLAMA_HOST variable is set to that address, anyone who knows your IP address can send requests to the model and potentially do more. The default is 127.0.0.1, and it should stay that way. Use an SSH tunnel or WireGuard for remote access rather than opening a port. Second, upgrade LiteLLM to the version with the April patch or later; if you don’t know which version you have, assume it is vulnerable. Third, keep Gotenberg and Gitea on an internal network only - Gotenberg’s documentation is explicit about this.

There’s a simple diagnostic: a miner is hard to hide from your system monitors. If your GPU is reaching 70 degrees and its fans are running when nobody is sending a model request, that is not “the model warming up” - someone may be mining. Check for processes with names resembling system daemons that are using all your CPU, and for outbound connections to mining-pool ports. Lumen has published indicators of compromise in its GitHub repository and blocked all traffic to and from PoeLLM command servers across its backbone network. That does not mean the campaign is over; it means only that one major route has been closed.

Why these campaigns are likely to become more common

Tools for running models locally were built with developer workflows in mind: they should work immediately after installation, without configuration, a password or a certificate. That is a reasonable assumption for something running on a laptop. It stops being reasonable when the same package ends up on a server with four GPUs and a public IP address because a team needed “something quick to test” and the test environment was never taken down.

Stealing computing power is also the mildest outcome for an inadequately secured model gateway. In the Canto Incognito campaign, infected servers also became scanners and exploit servers, attacking other machines on their owner’s behalf. A worse version of the same story would involve API keys stored in LiteLLM’s configuration being exposed. The resulting bill would not be about $94 a month for electricity; it would be whatever someone managed to spend generating tokens on your model-provider account before you noticed. At rates for large reasoning models, that amount could rise within a day to a level that makes a month of Monero mining look like pocket change.

Facts checked on October 14, 2026. Sources: Tom’s Hardware - report on the Canto Incognito campaign, Lumen Black Lotus Labs, US CISA Known Exploited Vulnerabilities catalogue (CVE-2026-42271). The electricity-cost estimates are approximate conversions of the original calculation, which used a small-business electricity rate.

Frequently asked questions

How did PoeLLM malware hide its command-server address?

The attacker posted a poem titled On the Nature of Connection on GitHub. Four specific words encoded an IPv4 address. When the infrastructure needed to move, the attacker changed those words and pushed a new commit - 11 times in total.

How much can a month of cryptocurrency mining cost the owner of an infected server?

An infected machine with an RTX 4090 running continuously draws about 450 W more than when idle, or 324 kWh a month. At the approximate electricity rate used in the original calculation, that works out to about $94 a month, or more than $1,130 a year.

How many servers may have been infected in the Canto Incognito campaign?

Researchers reported more than 3,400 infected servers. Lumen has not published a geographic breakdown, so the number of victims in any particular country cannot be established from the campaign report.

// read moreMidnight Mimosa: How to Check for Malware on a New Android PhoneGuidesOllama: How to Run AI Models Locally on Your ComputerGuidesAnthropic’s AI agents given same task escalated into malware warfareNews

Kinetyra