PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

Researchers report a campaign called Canto Incognito that deploys the PoeLLM malware to target exposed AI/LLM and internet-facing services (e.g., LiteLLM, Gotenberg, Gitea, Ivanti Sentry), installing XMRig/Iron miners and linking victims to the Kryptex mining service; infected hosts are reused as scanners and exploit servers to expand the botnet. Active since April 2026 with more than 3,400 identified victims (peak ~2,200 affected servers), the campaign uses a novel poem-based C2 hiding technique and has been attributed with moderate confidence to an Italian-speaking actor.