Lumen Black Lotus Labs says malware it calls PoeLLM has affected more than 3,400 servers since April 2026, turning compromised machines into cryptocurrency miners and, in some cases, scanners for further targets. The campaign, named Canto Incognito by the researchers, reached internet-facing AI services as well as a PDF converter and a development platform. Its lesson for operators lies in that mix: the exposed service and its configuration matter more than the AI label.

Lumen published its investigation of PoeLLM on October 7, according to contemporaneous reports from The Hacker News and The Register. The researchers date the first commit to the campaign's GitHub repository to April 13 and say broader scanning and exploitation followed in May. Their total is a count of servers identified through Lumen's investigation, not a census of every deployment of the named products. The company says most observed victims appeared to run vulnerable, publicly exposed services and that the concentration was in the United States and Western Europe.

A poem used as an address book

PoeLLM reads selected words from a poem in a GitHub repository and uses a dictionary embedded in the malware to derive its current command-and-control address. Editing those words lets the operator point infected systems at a new server without changing the malware on each host. Lumen counted 11 changes to the poem after the initial commit. The poem was a way to locate the operator's infrastructure; it did not trick an AI model into following instructions. Lumen's assessment that the actor is Italian-speaking rests on Italian-language artifacts and network traffic. That remains an attribution judgment, not an identified person or confirmed location.

The researchers report XMRig and Iron miners in the malware and connections to Kryptex mining infrastructure. They also saw infected hosts scanning and serving attacks against other exposed systems. Lumen says its network telemetry linked more than 1,000 additional IP addresses to an early command server. At a mid-June peak, it described almost 2,200 affected servers and nearly 800 active in a day. Its October headline figure of more than 3,400 is cumulative; these figures measure different things at different times. Lumen later blocked traffic to and from command servers it identified. The Hacker News subsequently reported that the poem repository had become unavailable, but that observation alone does not establish that every infected host was cleaned or that the actor stopped.

The exposure behind the AI headline

Lumen names LiteLLM and Ollama among AI-related services observed on victim IPs, alongside Gotenberg and Gitea. It also describes a compromised Ivanti Sentry device during its investigation, while treating wider targeting of that product as possible. The report does not provide a product-by-product victim count, a complete version inventory or proof that every exposed Ollama or LiteLLM instance was vulnerable. A service banner on an IP address can help identify a system, but it does not by itself prove the exact entry point on every host.

One LiteLLM path has firmer version detail. Lumen found a malware sample referencing a test endpoint associated with CVE-2026-42271. The published advisory lists LiteLLM versions 1.74.2 through those before 1.83.7 as affected, with 1.83.7 patched. It says the test endpoints required a valid proxy API key but lacked the necessary role check. That condition matters: the advisory describes authenticated command execution, while Lumen describes suspected use of one endpoint in a sample. Neither document proves that this vulnerability explains every PoeLLM infection.

Gotenberg shows a different, concrete exposure problem. Its installation guide tells users to keep the PDF conversion service behind a firewall. The guide also warns that published Docker ports may be reachable from outside and demonstrates binding the service to localhost. Its configuration reference documents optional basic authentication and OIDC, with both disabled by default in the listed settings. Operators should verify the version and deployment pattern they actually run before relying on any setting.

The big change

PoeLLM's reported scale makes internet exposure of supporting tools an immediate inventory question for AI teams. The campaign crossed product categories because the operator looked for reachable, vulnerable services and reused infected hosts to search for more. The poem made command-server changes easier, but the documented operator response is conventional: find the exposed service, establish its version and access controls, and check for signs of compromise. Lumen's telemetry supports the campaign account; it does not establish confirmed data theft or compromise across all deployments of the products it names.

A bounded check for operators

  1. Inventory internet-facing instances of LiteLLM, Ollama, Gotenberg and Gitea, including temporary deployments. Check the actual listening address, firewall and gateway rules, and whether access is required from the public internet.
  2. For LiteLLM, compare the installed version and enabled endpoints with the CVE-2026-42271 advisory. Update affected installations and review who has valid proxy keys; the advisory also documents a gateway block for the affected test endpoints when an immediate update is unavailable.
  3. Keep Gotenberg within the trusted network as its installation guidance recommends. Review the relevant authentication options in its configuration documentation for deployments that need controlled access.
  4. Compare network and host logs with Lumen's published indicators, and investigate unexpected mining activity, outbound command traffic or scanning. An indicator match needs incident review; absence of a match does not clear a host.

Sources & further reading