Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

Black Lotus Labs reported that a cryptomining botnet campaign it calls Canto Incognito, using malware dubbed PoeLLM, has infected more than 3,400 servers by breaking into exposed AI services and open-source tools and hiding its command-and-control addresses in a poem posted on GitHub. The researchers attribute the campaign to an Italian-speaking threat actor, and say the infected servers mine cryptocurrency and are used to hunt for new victims.