Lumen Technologies (Organization): news timeline & CVEs

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

PoeLLM malware has infected over 3,400 servers to build a cryptomining botnet called Canto Incognito.

Lumen Black Lotus Labs reported the Canto Incognito campaign, which has deployed PoeLLM malware since April 2026 to more than 3,400 servers, mainly in the United States and Western Europe. Infected hosts run XMRig and Iron cryptocurrency miners and connect to the Kryptex mining service. The malware derives its command-and-control address from selected words in a poem hosted on GitHub. It exploits exposed LiteLLM, Gotenberg, Gitea, and Ivanti Sentry systems, then turns victims into scanners that push the malware to new targets. Lumen attributes the activity to an Italian-speaking actor with moderate confidence.

The Hacker Newsupdated Oct 8, 10:24 UTC · 14h agofirst Oct 7, 15:33 UTC · 1d agoMalware in the wild 7 sources1

PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem

PoeLLM malware has compromised over 3,400 servers, encoding its command-and-control address in a GitHub poem.

Lumen Technologies’ Black Lotus Labs said PoeLLM malware has compromised more than 3,400 servers since April by targeting exposed services including LiteLLM, Ollama, Gotenberg, and Gitea. The malware reads a poem on GitHub and maps four words through a hard-coded dictionary to assemble its command-and-control IP, so operators can rotate infrastructure without updating implants. The botnet conducts exploit scanning and cryptocurrency mining and can run remote code, which researchers say could abuse AI models on victim servers. Italian-language comments and Italy-based servers suggest an Italian-speaking operator, with no observed links to known groups.

CyberScoopupdated Oct 8, 10:24 UTC · 14h agofirst Oct 7, 15:00 UTC · 1d agoMalware in the wild 7 sources1

Lumen Technologies

Timeline2 articles

Appears with

PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem