PoeLLM botnet hides C2 address via GitHub poem, infecting more than 3,400 servers

Black Lotus Labs discloses a mining botnet named Canto Incognito, whose malware PoeLLM resolves C2 server addresses by reading a GitHub poem titled On the Nature of Connection; the poem has been modified 11 times since its first commit in April 2026, each time pointing to a new server. The campaign has been running since April 2026 and has infected more than 3,400 servers, most located in the United States and Western Europe, with victims mostly running vulnerable versions of open-source AI/LLM services such as LiteLLM and Ollama, as well as Gotenberg and Gitea. Black Lotus Labs says it has blocked traffic to PoeLLM C2 servers and continues to monitor.