- Lumen says PoeLLM compromised more than 3,400 servers, with peak activity above 800 active systems in a day. <sup>[1]</sup>
- The campaign targeted internet-exposed LiteLLM and Ollama deployments, while also affecting Gotenberg and Gitea. <sup>[1]</sup>
- Defenders should review Black Lotus Labs’ indicators, remove unnecessary public exposure and patch vulnerable LiteLLM installations. <sup>[1]</sup><sup>[2]</sup>
A malware campaign targeting exposed AI infrastructure has compromised more than 3,400 servers since April, according to Lumen Technologies’ Black Lotus Labs. The victims were concentrated in the United States and Western Europe, and many appeared to run internet-facing LiteLLM or Ollama services. [1]
Black Lotus Labs named the malware PoeLLM and the campaign Canto Incognito. The malware installs cryptocurrency miners, including XMRig and Iron, and reuses compromised servers to scan for and exploit additional targets. Lumen said peak activity exceeded 800 active infected servers in a day. [1]
How the campaign spread #
The campaign scanned exposed services and used a crafted request against LiteLLM’s /mcp-rest/test/connection endpoint as a likely exploitation path tied to CVE-2026-42271. Lumen identified LiteLLM instances listening on port 4000 and Gotenberg instances on port 3000; it did not identify a separate Ollama vulnerability in the published research, only exposed and vulnerable deployments among the victims. [1]
PoeLLM retrieved its command-and-control address from four words in a poem stored in a GitHub repository. The operator changed the poem 11 times, allowing infected systems to calculate new C2 addresses without changing the malware binary. Black Lotus Labs identified 12 associated C2 addresses and said three remained active when its October 7 report was published. [1][3]
Lumen recommends checking network logs against its published indicators, auditing externally reachable AI services and limiting access to required ports. Organizations using LiteLLM should also review the project’s advisory for CVE-2026-42271 and update affected deployments. [1][2]
Further sources #
The stories that matter, in one email. Free — unsubscribe anytime.