A cryptomining campaign has compromised more than 3,400 servers by exploiting exposed artificial-intelligence services, development platforms and other internet-accessible applications.
Lumen Technologies’ Black Lotus Labs disclosed the campaign, named Canto Incognito, on October 7, 2026. The malware, called PoeLLM, remains active and continues searching for new victims, primarily in the United States and Western Europe.
The campaign is significant because compromised servers do more than mine cryptocurrency. They also scan for vulnerable systems and route attacks through victim infrastructure, helping the botnet expand while obscuring its operator’s location.
EXPOSED AI SERVICES BECOME PRIMARY TARGETS
Most identified victims appeared to operate vulnerable versions of open-source artificial-intelligence services, including LiteLLM and Ollama.
The campaign also compromised hundreds of servers running the Gotenberg PDF-conversion service and Gitea software-development platform. Black Lotus Labs found evidence suggesting that Ivanti Sentry appliances may also have been targeted.
The affected applications provide attackers with valuable computing power and, depending on their configuration, potential access to API credentials, model interactions, uploaded documents and internal development information.
Black Lotus Labs assessed that PoeLLM is associated with an Italian-speaking threat actor and has operated since at least April 2026. Researchers believe financial gain is the primary motivation, but the operator has not been publicly identified.
ATTACKERS EXPLOIT LITELLM REMOTE-CODE-EXECUTION FLAW
One confirmed attack path involves CVE-2026-42271, a critical remote-code-execution vulnerability affecting LiteLLM versions 1.74.2 through versions earlier than 1.83.7.
The vulnerability allowed an unauthenticated attacker to supply operating-system commands through exposed API endpoints without an appropriate authorization check. Successful exploitation could give attackers command execution on the server hosting the AI gateway.
LiteLLM corrected the vulnerability in version 1.83.7. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog in June after confirming exploitation.
Black Lotus Labs assessed that a specially constructed POST request to a LiteLLM connection endpoint was probably used during the PoeLLM campaign.
The specific vulnerabilities or access methods used against Ollama, Gotenberg and Gitea were not publicly detailed. Organizations should avoid assuming that CVE-2026-42271 was responsible for every infection.
Defenders should treat self-hosted AI services as production infrastructure. They require the same asset inventory, patch management, access restrictions, logging and incident-response coverage as public-facing web servers and remote-access appliances.