The poem is the command channel
Researchers at Lumen’s Black Lotus Labs have published an account of a cryptomining campaign they track as Canto Incognito, whose malware — PoeLLM — works out where to phone home by reading a poem.
The poem, titled “On the Nature of Connection”, sits in a file called dash.css in a GitHub repository that appears to be a fork of the Node.js website source. It has nothing to do with Node.js. PoeLLM takes four words from fixed positions in the text and maps each through a hard-coded dictionary to a number. The four numbers form the command-and-control server’s IPv4 address. In one sample, the words “driver”, “diode”, “decryption” and “string” produced 92.119.165.74.
The operator edited the poem eleven times. Each edit pointed every infected machine at a new server without the malware being updated, because the bots recompute the address themselves. Because the hosted file is plain text with no link and no download, it does not look like anything a scanner is trained to flag.
Who got hit
Black Lotus Labs counts more than 3,400 compromised servers, concentrated in the United States and Western Europe. Most were running vulnerable versions of LiteLLM, a proxy layer for language model APIs, and Ollama, which runs models locally. Hundreds of Gotenberg and Gitea servers were also caught.
The scanning concentrated on ports 3000 and 4000, the defaults for Gotenberg and LiteLLM. The sample the researchers examined reached a LiteLLM endpoint referenced in CVE-2026-42271, a command injection flaw, which they treat as the likely way in. The team first came across PoeLLM while investigating an unrelated Ivanti Sentry compromise, when a victim called out to the campaign’s infrastructure in early June.
What the machines were made to do
Infected hosts run the XMRig and Iron miners against the Kryptex pool. That is the revenue. The more awkward part for anyone running these services is that the malware also installs a remote shell, an HTTP and HTTPS scanner, and the ability to deploy exploits, which turns each compromised AI server into equipment for finding the next one.
Newer activity targets SSH and login portals, which the researchers read as early experimentation with distributed brute-forcing. The campaign has been running since April, when the first version of the poem was committed on 13 April.
The practical reading
Nothing in this campaign is novel as an intrusion. It is commodity cryptomining reaching an unpatched endpoint. What makes it worth reading is the target set: the exposed surface of self-hosted AI infrastructure is now large enough and consistent enough that a financially motivated operator can build a 3,400-machine botnet out of it alone.
The immediate action is narrow. Anyone running LiteLLM should be on a version past the fix for CVE-2026-42271, and anyone running Ollama or Gotenberg on a public address should check what those ports are exposed to. Black Lotus Labs has published indicators, including the command servers and malware hashes.
