{"slug": "cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers", "title": "Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers", "summary": "Black Lotus Labs reported that a cryptomining botnet campaign it calls Canto Incognito, using malware dubbed PoeLLM, has infected more than 3,400 servers by breaking into exposed AI services and open-source tools and hiding its command-and-control addresses in a poem posted on GitHub. The researchers attribute the campaign to an Italian-speaking threat actor, and say the infected servers mine cryptocurrency and are used to hunt for new victims.", "body_md": "Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-source tools, mines cryptocurrency on them and uses them to hunt for new victims. The researchers call the campaign Canto Incognito and believe it is the work of an Italian-speaking threat actor who appears to be in it … [More](https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/) \n\nThe post [Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers](https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).", "url": "https://wpnews.pro/news/cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers", "canonical_source": "https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/", "published_at": "2026-10-08 10:24:57+00:00", "updated_at": "2026-10-08 10:47:21.282820+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-tools"], "entities": ["Black Lotus Labs", "PoeLLM", "Canto Incognito", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers", "markdown": "https://wpnews.pro/news/cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers.md", "text": "https://wpnews.pro/news/cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers.txt", "jsonld": "https://wpnews.pro/news/cryptomining-botnet-hides-c2-addresses-in-github-poem-infects-over-3400-servers.jsonld"}}