Kryptex (Organization): news timeline & CVEs

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.

Black Lotus Labs tracks the 'Canto Incognito' campaign, active since April 2026 and attributed to an Italian-speaking financially motivated actor, which has compromised more than 3,400 servers, mostly in the US and Western Europe. The PoeLLM malware exploits vulnerable internet-exposed open-source services including LiteLLM (command injection, CVE-2026-42271), Ollama, Gotenberg, Gitea, and an Ivanti Sentry flaw (CVE-2026-10520), then deploys XMRig and Iron miners using the Russian Kryptex pool. C2 IPv4 addresses are decoded from four fixed words in a poem stored in a GitHub repository, edited 11 times to rotate C2 servers. Infected machines scan for new victims on ports 3000 and 4000 and have begun experimenting with distributed SSH brute-force attacks.

Help Net Security10:24 UTC · 13h agoMalware in the wild 7 sources CVE-2026-10520 CVE-2026-422711

Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure

PoeLLM malware uses a GitHub poem to derive C2 addresses and mine cryptocurrency on more than 3,400 exposed AI servers.

Lumen’s Black Lotus Labs says PoeLLM, active since at least April 2026, has compromised more than 3,400 servers, mostly in the United States and Western Europe. The malware reads four marked words from a poem in a GitHub repository and maps them to the current command-and-control IPv4 address, so operators can rotate infrastructure by editing the poem. It targets exposed LiteLLM, Ollama, Gotenberg, and Gitea services; one LiteLLM path is linked to command-injection flaw CVE-2026-42271. The Linux payload provides a remote shell, scanning, exploit delivery, and XMRig and Iron miners that contact Kryptex.

Cyber Security Newsupdated 10:24 UTC · 13h agofirst 09:14 UTC · 14h agoMalware in the wild 7 sources CVE-2026-42271

PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion

PoeLLM has compromised over 3,400 servers, mining cryptocurrency and spreading through exposed AI and web apps.

PoeLLM, active since April 2026, has compromised more than 3,400 servers, mainly in the United States and Western Europe, by abusing exposed LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry systems. Operators derive command-and-control addresses from a poem hosted on GitHub, and infected hosts run XMRig and Iron miners while scanning and exploiting further machines. One sample used LiteLLM authenticated command-execution flaw CVE-2026-42271, which version 1.83.7 fixes. Peak activity exceeded 800 servers a day, and Lumen said it blocked traffic to identified command servers.

GBHackersupdated 10:24 UTC · 13h agofirst 05:21 UTC · 18h agoMalware in the wild 7 sources CVE-2026-42271

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

PoeLLM malware has infected over 3,400 servers to build a cryptomining botnet called Canto Incognito.

Lumen Black Lotus Labs reported the Canto Incognito campaign, which has deployed PoeLLM malware since April 2026 to more than 3,400 servers, mainly in the United States and Western Europe. Infected hosts run XMRig and Iron cryptocurrency miners and connect to the Kryptex mining service. The malware derives its command-and-control address from selected words in a poem hosted on GitHub. It exploits exposed LiteLLM, Gotenberg, Gitea, and Ivanti Sentry systems, then turns victims into scanners that push the malware to new targets. Lumen attributes the activity to an Italian-speaking actor with moderate confidence.

The Hacker Newsupdated 10:24 UTC · 13h agofirst Oct 7, 15:33 UTC · 1d agoMalware in the wild 7 sources1

PoeLLM malware infects exposed AI servers in cryptomining attacks

PoeLLM cryptomining malware has compromised over 2,100 exposed AI servers, using GitHub poems for command-and-control.

Lumen's Black Lotus Labs says PoeLLM has compromised more than 2,100 servers, with as many as 800 infections active in one day, mainly in the United States and Western Europe. Active since at least April 2026, the Linux malware derives its command-and-control IPv4 address from keywords in a GitHub-hosted poem and has used at least 11 controllers. Compromised hosts scan, deploy exploits, open a remote shell, and run XMRig and Iron miners associated with the Russian service Kryptex. Targets include exposed LiteLLM, Ollama, Gotenberg, and Gitea; CVE-2026-42271 can be chained with CVE-2026-48710 for unauthenticated LiteLLM remote code execution. Researchers moderately assess the operator as Italian.

BleepingComputerupdated 10:24 UTC · 13h agofirst Oct 7, 15:04 UTC · 1d agoMalware in the wild 7 sources CVE-2026-42271

Kryptex

Timeline5 articles

Related CVEsby mentions

Appears with

Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure

PoeLLM Malware Hijacks 3,400+ Servers for Crypto Mining and Botnet Expansion

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

PoeLLM malware infects exposed AI servers in cryptomining attacks