AI-rewritten: This is a summary of an article from Tom’s Hardware, rewritten by AI (Qwen, running locally) to make it easier to read. The facts come from the original article – read it for the full story.

---

Researchers from Black Lotus Labs report that cryptomining malware named PoeLLM has infected over 3,400 servers since April 2026 in a campaign called Canto Incognito. The malware uses a unique command-and-control mechanism where it directs infected hosts to new control servers using four words from a two-stanza poem titled "On the Nature of Connection" hosted on GitHub. This specific poem has been altered eleven times to update the server locations, and the malware decodes these words into an IPv4 address to communicate with its operators.

The primary targets appear to be vulnerable versions of open-source AI services like LiteLLM and Ollama, as well as PDF conversion tools such as Gotenberg and Git platforms like Gitea. While a fix for LiteLLM was released in April, researchers note that many victims are still running older versions susceptible to exploitation via CVE-2026-42271. The malware utilizes XMRig and Iron miners connected to Kryptex infrastructure, turning the compromised servers into scanners and exploit tools.

Lumen states that traffic to all PoeLLM control servers has been blocked, but three of twelve known control servers remain active as of their report. The researchers warn that enterprise attack surfaces are expanding rapidly with AI infrastructure growth, making exposed services attractive targets for financial gain due to valuable data and hardware access. They advise users to audit external exposure, patch network devices, and update specific vulnerable products like LiteLLM and Ivanti Sentry according to the latest advisories.