A cryptomining campaign with a flair for poetry has hijacked more than 3,400 internet-exposed servers since April, and its most unusual feature is where it hides its instructions: inside a poem hosted on GitHub.
The malware family, dubbed PoeLLM, targets AI and developer infrastructure left open to the internet, according to research published this week by Lumen's Black Lotus Labs.
The broader operation behind it, which the researchers named Canto Incognito, installs cryptocurrency miners on compromised machines and then repurposes those servers as scanners and exploit launchpads to infect even more victims.
At its peak, as many as 800 infected systems were active on a single day, and the researchers say they have stood up at least 11 command-and-control servers so far.
The campaign has been active since at least April but has accelerated significantly since then.
A poem as a phone book
Instead of a conventional domain or a hardcoded IP address, PoeLLM hides the location of its command-and-control server inside a poem the attacker wrote and committed to a public GitHub repository.
The malware, a Linux ELF binary masquerading as a file named libgcrypt, pulls four words or phrases from the poem inside a dash.css file and maps them to numbers through a hardcoded dictionary to derive an IPv4 address.
Each time the operator needs a new command server, they simply change a few words in the poem, and every infected machine follows the update.
"To anyone who comes across it, this is simply a poem on GitHub," the researchers told The Register.
"There would be no reason for any security researcher to identify this poem as malicious — or know about the IP address hidden within it — unless they had access to the malware referencing it."
It is, the researchers said, the first time they have seen this technique used in a real-world attack: the poem contains no links, no files to download, and no encrypted text that could trip an automated scanner.
GPU muscle made it a target
The victims are mostly enterprise, internet-facing deployments running tools such as LiteLLM and Ollama for AI workloads, alongside the Gotenberg document converter, the Gitea code-hosting platform, and Ivanti Sentry gateway appliances.
The campaign concentrates on the United States and Western Europe.
According to the research, the attackers exploit exposed instances of these services to drop PoeLLM, then install the XMRig and Iron cryptocurrency miners, connecting victims to the Kryptex mining service.
Infected hosts are then reused to expand the botnet, scanning for more exposed systems and attempting a LiteLLM exploit against them.
The threat hunters first spotted PoeLLM while investigating an Ivanti Sentry vulnerability, and Lumen assessed with moderate confidence that the financially motivated operator may be based in Italy.
That assessment is based on comments in the malware and an Italy-based server hosting an administrative interface — not a confirmed attribution.
AI systems are soft targets
Black Lotus Labs notes that AI and large language model infrastructure is a natural target: these systems are frequently misconfigured or left exposed online, and they typically run on powerful GPU clusters that are ideal for cryptomining.
The practical advice for administrators is unglamorous but essential: apply updates, close off vulnerable endpoints, and keep AI services off the public internet.
If a server is already mining cryptocurrency for someone else, it can be repurposed for far worse — and in this campaign, the poem on GitHub will already know the way home.
By Hamza Faisal
