Executive Summary
Since April 2026, a campaign dubbed 'Canto Incognito' has been identified targeting exposed AI and LLM infrastructure, including LiteLLM, Ollama, and development tools like Gitea. The campaign utilizes a sophisticated ELF malware named PoeLLM (libgcrypt), which has compromised over 3,400 servers across the United States and Western Europe. The primary objective is financially motivated cryptomining using XMRig and Iron miners connected to the Kryptex pool.
The attack chain leverages vulnerabilities in internet-facing AI tools, specifically chaining CVE-2026-42271 and CVE-2026-48710 to achieve remote code execution. A standout feature of PoeLLM is its C2 retrieval method; it parses a specific poem hosted in a GitHub CSS file to derive IPv4 addresses for its command servers. Black Lotus Labs, who discovered the threat, attributes the activity to a suspected Italian-speaking actor based on code comments and administrative infrastructure location.
This threat highlights the growing risk to high-performance GPU clusters used for AI workloads. Organizations deploying self-hosted LLM services are at high risk if these tools are exposed without proper authentication or firewalling, as they provide both significant compute power for miners and a launchpad for further network scanning.