PoeLLM: The malware using poetry to hijack AI servers

A new paradigm in AI cybercrime: The Canto Incognito case

Cybersecurity in the Artificial Intelligence ecosystem has entered a critical phase with the revelation of the Canto Incognito campaign. According to an analysis by Black Lotus Labs, the threat intelligence division of Lumen, more than 3,400 servers have been compromised by the PoeLLM malware. This incident is not just an isolated intrusion, but a sign of how AI infrastructure has become the new preferred target for organized cybercrime, shifting the traditional focus away from consumer workstations.

The anatomy of the attack: Literary steganography and evasion

The sophistication of PoeLLM lies in its C2 (command and control) communication method. Unlike attacks that use algorithmically generated domains (DGA) or static IP addresses, the attackers have implemented a form of digital steganography: the use of poetry hosted on public GitHub repositories. In this scheme, the malware downloads specific stanzas and uses predefined keywords as coordinates to decode the remote server's IP address. This mechanism has been updated at least 11 times since April 2026, demonstrating a technical adaptability that severely complicates detection efforts by conventional intrusion detection systems (IDS).

Forensic analysis indicates that, once compromised, the servers not only run cryptocurrency miners like XMRig and Iron—connected to the Kryptex infrastructure—but also act as scanning and propagation nodes. This turns each victim into an attack vector, exponentially amplifying the campaign's reach and transforming high-performance servers into illicit monetization tools for the attacker.

Why Ollama, LiteLLM, and Gotenberg?

The choice of targets by the Canto Incognito operators reveals a deep understanding of current weaknesses in the architecture of companies adopting AI. Tools like Ollama, which allows for running local language models, and LiteLLM, an essential gateway for unifying API calls, are being deployed en masse without the necessary network safeguards. The problem is compounded by Gotenberg, an API for document conversion, whose manuals explicitly warn about the dangers of public exposure—a warning frequently ignored in agile development environments.

Historically, system administrators have prioritized functionality and low latency over perimeter security in testing environments. However, this incident proves that leaving an endpoint exposed to the public network, even if it is considered a development environment, is an open invitation for malicious actors. The lack of robust authentication in outdated versions of these tools is the entry vector that has enabled this systemic attack.

Market impact and historical context

This episode marks a significant paradigm shift. Over the last decade, cryptomining malware primarily focused on personal PCs or web browsers via cryptojacking. Today, the value lies in the computing power of GPUs, which are the engine of the AI revolution. AI infrastructure not only offers access to computing resources but often acts as a bridge to sensitive corporate data.

Compared to past incidents like Mirai-type botnet campaigns, which exploited IoT devices, Canto Incognito is much more dangerous because it infiltrates the very core of modern IT infrastructure. While Mirai sought devices with default passwords, PoeLLM exploits business logic and AI middleware configuration, an area where security standardization is still nascent. Current speculation suggests that while the motive appears to be financial mining (given the connection to Russian cryptomining services), the created infrastructure could be used for much more complex attacks, such as the theft of proprietary data or the training of malicious models through injections into data pipelines.

Strategic recommendations for administrators

To mitigate risks in the face of this new landscape, it is essential to adopt a defense-in-depth approach:

• Exposure auditing: It is imperative to audit all AI services and gateways. Tools like Ollama or LiteLLM should never be exposed directly to the public network; they must be protected by a reverse proxy with mutual authentication (mTLS) and role-based access control.
• Proactive patch management: The vulnerability exploited in LiteLLM already had a patch available since April 2026. The delay in updating open-source software components is the weakest link in the current security chain.
• Outbound traffic monitoring: Implement strict egress filtering firewall rules. An AI server should have no need to communicate with unknown code repository domains or cryptocurrency mining pools.
• Network segregation: Isolate AI inference environments into network segments with restricted internet access, allowing only the connections strictly necessary for downloading models or calling authorized APIs.

The Canto Incognito case is a wake-up call for the industry: the speed of AI innovation should not be an excuse to neglect the fundamentals of cybersecurity. As organizations scale their AI capabilities, perimeter security and vulnerability management in AI middleware will be the critical defenses to prevent the new digital gold from ending up in the hands of third parties.