PoeLLM botnet mines crypto on exposed AI servers — patch LiteLLM and take Ollama off the internet

A botnet that Lumen's Black Lotus Labs calls PoeLLM has been breaking into internet-facing AI servers since April 2026, mainly LiteLLM gateways and Ollama model servers, to mine cryptocurrency and to recruit them into scanning for more victims. If you run LiteLLM, make sure you are on version 1.83.7 or later; if you run Ollama, Gotenberg or Gitea, check that they are not reachable from the internet, and check your logs against the published indicators.

What happened, in plain English

Many companies now run their own "AI plumbing". LiteLLM is a gateway: one server that sits between your applications and the AI models they call, handling API keys and routing. Ollama is a tool for running AI models on your own hardware. Both are free, open-source and quick to install, which is exactly why some of them end up exposed to the internet with little protection.

On October 7, 2026, researchers at Black Lotus Labs, the threat-intelligence team of the network operator Lumen, described a campaign they named "Canto Incognito". Its malware, PoeLLM, scans the internet for these services, breaks in through known weaknesses, and installs two cryptocurrency miners, programs that use the victim's processors to earn money for the attacker. Each infected machine then becomes a scanner and attacker itself, looking for the next victim.

The name comes from an unusual trick. The malware does not contain the address of its control server (the "C2", for command and control). Instead, it reads a poem stored on GitHub, picks out four words, and turns them into the four numbers of an IP address. When the operator wants to move, they edit a few words of the poem. Lumen counted 11 such edits.

An analogy: a burglar who moves into your spare room, runs up your electricity bill, and uses your house as a base to case the rest of the street, while checking a public noticeboard for where to meet next.

Lumen says most victims are in the United States and Western Europe.

Are you affected? What to do now

Who should care: anyone who runs LiteLLM, Ollama, Gotenberg (a document-to-PDF conversion service) or Gitea (a self-hosted Git service) on a server that can be reached from the internet. If your organisation only uses hosted AI products such as ChatGPT or Copilot, this campaign does not target you directly.

Checklist, in order:

• Find your AI services. Ask development and data teams whether anyone has deployed LiteLLM, Ollama or similar tools, including on test or GPU machines. Lumen's own advice is to audit your external exposure "after installing new open source tools".
• Patch LiteLLM to 1.83.7 or later. The flaw Lumen links to this campaign, CVE-2026-42271, affects versions 1.74.2 up to (but not including) 1.83.7. The project's advisory says that, if you cannot upgrade at once, you should block the two endpoints POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list. The US Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities catalogue on June 8, 2026.
• Take Ollama, Gotenberg and Gitea off the open internet. Put them behind a firewall, a VPN or an authenticating reverse proxy. Lumen says the scanning focused mainly on ports 3000 (used by Gotenberg) and 4000 (used by LiteLLM). Restrict service ports to the minimum needed.
• Rotate LiteLLM keys. The LiteLLM flaw requires a valid proxy API key, even a low-privilege one. Lumen does not say how the attackers obtained keys, so treat any key that may have been exposed (in code, config files or shared documents) as compromised.
• Check for signs of infection. Unexplained high CPU or GPU usage, unknown processes, and outbound connections to mining pools are the obvious signs. Lumen names the payload file "libgcrypt" (an ELF binary, the Linux executable format), which imitates the name of a real system library.
• Compare network logs with the official indicators. Black Lotus Labs publishes 12 control-server IP addresses and 3 file hashes in its GitHub repository (link below). As of October 7, 2026, it lists three addresses as still active: 92.119.164.50, 103.249.201.108 and 178.128.14.204.
• If you find an infected server, rebuild it rather than cleaning it, and rotate every credential and API key it held, including the keys LiteLLM uses to reach paid AI providers.

Also on the list: Lumen found the campaign while investigating CVE-2026-10520, a flaw in Ivanti Sentry, a mobile-device gateway, that CISA added to its catalogue on June 11, 2026. If you run Ivanti Sentry, confirm it is patched.

The expert view

Most of what PoeLLM does is old. Commodity cryptominers that spread by exploiting known bugs in exposed services and reuse each victim as a scanner have been around for a decade; the miners here (XMRig among them) are standard. What has changed is the target list. Lumen's device data showed that most victim addresses were running LiteLLM and Ollama, and the researchers state plainly that "AI infrastructure is becoming an attractive target".

There are three reasons this is predictable. First, these tools are often deployed by developers outside the usual change process, on cloud instances with public IPs, and they rarely appear in the asset inventory the security team patches from. Second, an AI gateway is a concentration point: it holds API keys for paid model providers, may see prompts and data, and often has broad network reach. Lumen notes that exposed AI services can "contain useful data" and that the GPU hardware behind them may be attractive in its own right. Third, the vulnerability classes are familiar. CVE-2026-42271 is command injection: two LiteLLM endpoints meant to preview a Model Context Protocol (MCP) server configuration accepted a configuration that launches a local program, and checked only that the caller had a valid key, not what role it had. (LiteLLM's key handling has been in the news before: we covered a separate flaw that turns any valid login token into an admin account.)

The C2 mechanism is the genuinely new detail, though it is a variation on an old idea, "dead drop" resolvers that hide a control address in public content. Using a poem on a major code-hosting site means the lookup traffic goes to a domain almost every company allows, and moving infrastructure costs the operator a few edited words. Lumen also reports that the operator reused compromised routers with vulnerable admin pages as control servers. Defenders should not expect to block such a campaign by domain; exposure management and patching are where it is stopped.

What is still unknown:

• The size. Lumen's report gives two different figures: "more than 3,400 victim servers" in its key takeaways, and "almost 2,200" in the body, describing the mid-June peak, with nearly 800 active per day at that peak. We report both.
• How Ollama hosts were compromised. Lumen names Ollama among the targets but does not name an Ollama vulnerability or method.
• How LiteLLM keys were obtained. CVE-2026-42271 requires a valid key, and Lumen says only that this endpoint was "likely the exploitation path".
• Who is behind it. Lumen assesses the actor as Italian-speaking, based on Italian-language code comments, and assesses with moderate confidence that a server in Italy is the operator's administrative interface. It makes no further attribution.
• What comes next. Lumen observed recent traffic towards SSH and other login portals, which may be early experiments with distributed password-guessing; it says the maturity of that capability is uncertain.

Official sources

• Lumen Black Lotus Labs, "Canto Incognito: Tracking the PoeLLM malware" (October 7, 2026).
• Black Lotus Labs, PoeLLM indicators of compromise.
• LiteLLM security advisory GHSA-v4p8-mg3p-g94g (CVE-2026-42271).
• LiteLLM release v1.83.7-stable.
• CISA Known Exploited Vulnerabilities catalogue.

Coverage:

• The Hacker News, "PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet" (October 7, 2026).
• Help Net Security, "Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers" (October 8, 2026).