The Canto Incognito Campaign
Over 3,400 victim servers were hit by cryptomining malware PoeLLM during a campaign named Canto Incognito, tracked since April 2026, according to cybersecurity researchers. The malware’s command-and-control mechanism used address encoding through four words in a two-stanza poem on GitHub, altered 11 times so far, to direct affected hosts to new servers. Most of those hit appear to be running vulnerable versions of open-source AI and LLM services.
The malware’s payload consists of XMRig and Iron miners connected to mining infrastructure, with infected servers subsequently operating as scanners and exploit servers. The primary commonality among the first 900 victims was contact with an endpoint for a crypto mining service, indicating potential financial motivation. Researchers note that AI infrastructure is becoming an attractive target because exposed AI services may contain valuable data and hardware access, particularly GPUs.
Targeted Services and Vulnerabilities
Primary targets include LiteLLM, an AI gateway proxy server, and Gotenberg, a Docker-based API for PDF conversion. Also affected are Ollama, which allows local execution of open-weight models, and Gitea, a self-hosted Git platform. An enterprise gateway appliance may also have been targeted during the campaign.
Although the malware’s methodology involves leveraging poetry, this is solely used to point infected servers to the command-and-control infrastructure. It is not a form of AI jailbreak through harmful requests or prompt injection.
The poem, titled On the Nature of Connection, was first committed in April, with each new version pointing to a new server address. The malware decodes the new address by extracting specific words and converting them into an IPv4 address. Researchers stated that the pattern used to decipher the poem remained consistent during the reporting period.
Exploitation and Mitigation
The malware is deployed through vulnerability exploitation of publicly exposed services. For LiteLLM, a crafted POST request to the connection endpoint served as the exploitation path due to a flaw that executed supplied commands without a role check. Administrators are advised to check connection logs for indicators of compromise, audit external exposure, close unnecessary ports, and apply patches for vulnerable software versions.
Administrators looking to secure systems should review connection logs against published indicators of compromise. It is recommended to audit external exposure when installing open-source tools, close unnecessary network ports, and follow individual product advisories to apply necessary patches.
At the time of publication, several command-and-control servers remained active while the campaign continued to infect new victims. Security firms expect similar attacks to persist as enterprise attack surfaces expand alongside growing AI infrastructure deployments.
