GoKawiilCryptomining malware PoeLLM hits over 3,400 servers via poem-based C2, Black Lotus Labs finds
Lumen's Black Lotus Labs reports that a campaign called Canto Incognito has infected more than 3,400 servers since April 2026 using malware dubbed PoeLLM, which deploys XMRig and Iron cryptominers linked to Kryptex mining infrastructure. The malware hides its command-and-control addresses inside words of a two-stanza poem posted on GitHub, edited 11 times to redirect infected machines to new servers, and primarily targets exposed AI/LLM tools like LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry.