BuildIndependently confirmed2 publishers2 min readPublished
A GitHub poem edited 11 times keeps pointing infected servers to new command hosts
Lumen's Black Lotus Labs found a cryptominer on more than 3,400 servers, mostly running vulnerable AI services. Each poem edit moves the hosts to a new control server, so patching and closing public ports are the controls a server owner holds.
The Engineer · Build desk
Key figures: over 3,400 victim servers hit by the PoeLLM cryptominer; 3 C2 servers active when Lumen published, out of 12 C2 servers; and the first 900 victims, per Lumen.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Victim servers hit by PoeLLM, over | 3,400 servers | 1 | |
| C2 servers active when Lumen published | 3 servers | out of 12 C2 servers | 9 |
| First victims, per Lumen | 900 victims | 7 |
What happened
- The malware pulls specific words from the poem and converts them into an IPv4 address, and each new version of the poem points to a new C2 server.
- The payload is XMRig and Iron miners wired to Kryptex mining infrastructure, and each infected server also becomes a scanner and exploit server for the next round.
- For LiteLLM, a crafted POST to the connection endpoint was likely the path, through CVE-2026-42271, a missing role check that CISA listed as exploited in June.
- Gotenberg and Gitea are also among the victims, and Ivanti Sentry may have been targeted; one Sentry instance is how Lumen found the campaign.
Why it matters
- contradiction Lumen's report gives an exploitation path only for LiteLLM, and even that one is rated likely, so the published record cannot split the 3,400 between LiteLLM and Ollama flaws.
- exposure Ollama is not internet-exposed by default and Gotenberg has a guide warning against exposing it, so an infected instance of either was most likely opened up by its operator.
- decision Teams get two fixed versions to aim at: LiteLLM 1.83.7 or later and Ivanti Sentry R10.5.2, R10.6.2 or R10.7.1. Everything else is checked by searching connection logs for the indicators on Lumen's GitHub page.
- precedent Lumen says enterprise attack surfaces are "expanding rapidly as AI infrastructure grows", and Tom's Hardware judges more attacks like this one likely.
The poem is only a pointer. Tom's Hardware notes that it is not a jailbreak, a prompt injection or the "adversarial poetry" described in a paper last year [18]. Its title, "On the Nature of Connection", is at least on topic [11]. The researchers told The Register that a poem is "a perfect vehicle for hiding an important message" [12].
The design gives the operator one cheap lever. Committing a new version redirects the infected hosts to a new C2 server [3]. The decoding side has stayed put. Lumen said at the time of reporting that "the malware creator has not changed the pattern used in deciphering the poem" [5]. Count the first commit as a version and 11 edits make 12 versions, the same as the 12 C2 servers in Lumen's count [20]. If each version maps to one server, the commit history is a log of the operator's addresses.
Lumen blocked all traffic to and from the PoeLLM C2 servers [10]. The dev.to summary says the block limits the operator's ability to send new commands to infected systems [14]. It does not clean a host. The miner stays until its owner removes it. When Lumen published, nine of the 12 servers were not active, a share of 75 percent [19], yet the campaign "continues to infect new victims" [13].
The sequence on LiteLLM is short. Black Lotus Labs has tracked the campaign since April [1]. Tom's Hardware says an April LiteLLM fix probably patched the exploitation path [8]. Broad scanning began in May [15]. If the fix covers that path, a host updated in April was patched before the scanning started [21]. In our view, the LiteLLM victims are a patch-cadence problem.
The first 900 victims shared one thing: contact with "an endpoint for the Russian crypto mining service," according to Lumen, and Tom's Hardware says that points to a possible financial motive [7]. Tom's Hardware also quotes the report on why AI hosts draw attention: "AI infrastructure is becoming an attractive target" because exposed AI services may contain valuable data and hardware access, especially GPUs [22].
What to watch
- Whether the poem's decoding pattern changes. Lumen said it was unchanged at reporting, so a change would break any detection built on it.
- Whether the poem gets a thirteenth version or a new repository once the remaining active C2 servers are blocked.
- Whether Lumen publishes the exploitation methods for Ollama, Gotenberg and Gitea, which the report summary does not detail.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+8
- Incentives
- Insufficient
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Lumen's Black Lotus Labs reports that over 3,400 victim servers were hit by cryptomining malware PoeLLM during a campaign named Canto Incognito, tracked since April 2026.
ReportedSupportedSource: Lumen Black Lotus Labs, as reported by Tom's Hardware2 sources— create a free account to open themView cited source - [2]
The malware's C2 mechanism encodes addresses in four words of a two-stanza poem on GitHub, altered 11 times so far, to direct affected hosts to new C2 servers.
ReportedSupportedSource: Lumen Black Lotus Labs, as reported by Tom's Hardware2 sources— create a free account to open themView cited source - [3]
The poem was first committed in April, and each new version points to a new C2 server.
ReportedSupportedSource: Tom's Hardware2 sources— create a free account to open themView cited source - [4]
The malware decodes the new address by pulling specific words from the poem and converting them into an IPv4 address.
ReportedSupportedSource: Tom's Hardware2 sources— create a free account to open themView cited source - [5]
Lumen says that "the malware creator has not changed the pattern used in deciphering the poem" at the time of reporting.
ReportedSupportedSource: Lumen Black Lotus Labs, as quoted by Tom's Hardware2 sources— create a free account to open themView cited source - [6]
The malware's payload consists of XMRig and Iron miners connected to Kryptex mining infrastructure, and infected servers become scanners and exploit servers.
ReportedSupportedSource: Tom's Hardware2 sources— create a free account to open themView cited source - [7]
The "primary commonality amongst the first 900 victims" was contact with "an endpoint for the Russian crypto mining service," Lumen says; Tom's Hardware says this indicates the campaign may be financially motivated.
ReportedSupportedSource: Lumen Black Lotus Labs, as reported by Tom's Hardware2 sources— create a free account to open themView cited source - [8]
Most of the hosts hit look to be running vulnerable versions of open-source AI/LLM services such as LiteLLM and Ollama, despite an April LiteLLM fix that probably patched the exploitation path.
ReportedSupportedSource: Tom's Hardware, summarizing Lumen's report2 sources— create a free account to open themView cited source - [9]
When Lumen published its report, three of the 12 C2 servers were still active.
ReportedSupportedSource: Tom's Hardware, citing Lumen2 sources— create a free account to open themView cited source - [10]
Lumen says it has "blocked all traffic to and from the PoeLLM C2 servers."
ReportedSupportedSource: Lumen, as quoted by Tom's Hardware2 sources— create a free account to open themView cited source - [11]
The poem is titled "On the Nature of Connection".
ReportedSupportedSource: Tom's Hardware2 sources— create a free account to open themView cited source - [12]
The researchers told The Register that a poem is "a perfect vehicle for hiding an important message."
ReportedSupportedSource: Lumen researchers, via Tom's Hardware citing The Register2 sources— create a free account to open themView cited source - [13]
The campaign "continues to infect new victims" as of Lumen's report.
ReportedSupportedSource: Lumen, as quoted by Tom's Hardware2 sources— create a free account to open themView cited source - [14]
Lumen has blocked communication to the control locations used by the perpetrators, limiting the ability to send new commands to the infected systems.
ReportedSupportedSource: dev.to summary of Lumen's Black Lotus Labs research2 sources— create a free account to open themView cited source - [15]
The malware is "deployed through vulnerability exploitation of publicly exposed services," with broad scanning beginning in May.
- [16]
For LiteLLM, a crafted POST to the connection endpoint was likely the exploitation path, based on a flaw where two endpoints would run a supplied command on the host with no role check (CVE-2026-42271), which CISA added to its list of exploited vulnerabilities in June.
- [17]
Fixed versions are LiteLLM 1.83.7 or later and Ivanti Sentry R10.5.2, R10.6.2 or R10.7.1; to check systems, look at connection logs for the indicators of compromise listed on Lumen's GitHub page.
- [18]
The poem is used only to point infected servers to the C2 server; it is not an AI jailbreak through harmful requests, prompt injection, or the "adversarial poetry" described in a paper last year.
- [19]
Nine of the 12 C2 servers were not active when Lumen published, which is 75 percent.
- [20]
Counting the first commit as a version, 11 edits give 12 poem versions, equal to the 12 C2 servers Lumen counted.
- [21]
If the April LiteLLM fix covers the exploitation path, a host updated in April was patched before the May scanning began.
- [22]
"AI infrastructure is becoming an attractive target" because exposed AI services may contain valuable data and hardware access, especially GPUs.
ReportedInsufficientSource: Lumen report, as quoted by Tom's Hardware2 sources— create a free account to open themView cited source - [23]
Lumen says enterprise attack surfaces are "expanding rapidly as AI infrastructure grows," and Tom's Hardware says more attacks like this seem likely.
ReportedInsufficientSource: Lumen, as quoted by Tom's Hardware2 sources— create a free account to open themView cited source - [24]
Lumen did not detail the exploitation methods for Ollama, Gotenberg and Gitea.
- [25]
Ollama is not internet-exposed by default, and Gotenberg has a guide warning not to expose it to the internet.
- [26]
Gotenberg and Gitea are among the affected products, and Ivanti Sentry may also have been targeted; one Sentry instance was how Lumen discovered the campaign.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toThousands of computers infected with malware that generates digital currencies
1 article · October 12, 2026
- tomshardware.comCryptomining malware that locates its control server in a GitHub poem has hit more than 3,400 servers, researchers say
1 article · October 11, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Command-and-control techniquesFollow
- AI Infrastructure SecurityFollow
- CryptojackingFollow