PoeLLM Botnet Hides C2 in GitHub Poem, Infects 3,400 Servers

Black Lotus Labs has identified a cryptomining botnet campaign named Canto Incognito that compromises servers by extracting command-and-control addresses from a poem hosted on GitHub. According to Help Net Security, the malware, dubbed PoeLLM, has infected more than 3,400 servers.

The threat actor behind the campaign uses an exposed AI service or open-source tool as an entry point. Once inside, the malware mines cryptocurrency on the compromised infrastructure. It also uses the infected servers to scan for and infect additional victims, expanding the botnet’s reach. The command-and-control infrastructure is uniquely obfuscated by embedding server addresses within the text of a poem published on GitHub, a technique designed to evade standard detection methods.

Campaign Mechanics and Origin

Researchers from Black Lotus Labs attribute the Canto Incognito campaign to a threat actor who appears to be Italian-speaking. The group’s operational security relies heavily on the unconventional method of hiding infrastructure details in plain sight on a public code repository. By forcing the malware to parse a poem to locate its next commands, the attackers add a layer of complexity that differs from traditional hardcoded C2 addresses.

The infection vector targets exposed services, specifically highlighting vulnerabilities in AI services and open-source tools. This suggests that the attackers are actively scanning for misconfigured or unprotected endpoints that allow unauthorized access. The primary goal of the compromise is financial gain through cryptocurrency mining, leveraging the computational power of the hijacked servers.

Impact and Scope

The scale of the infection is significant, with Black Lotus Labs reporting that over 3,400 servers have been compromised. These servers are not merely passive victims; they are actively used to hunt for new targets. This dual purpose—mining cryptocurrency and acting as a scanning node for further infection—accelerates the spread of the botnet.

The reliance on GitHub for hosting the poem that contains the C2 addresses introduces a supply-chain-like risk. If the poem is removed or altered, the botnet’s ability to communicate with its controllers could be disrupted, but the initial compromise remains a severe threat to the affected organizations. The use of open-source tools and AI services as entry points indicates a broad attack surface that many organizations may have overlooked.

What should you do?

Organizations should audit their exposed services, particularly AI endpoints and open-source tools, for unauthorized access. Monitoring for unusual outbound traffic that might indicate communication with GitHub or other unexpected domains is recommended. Security teams should review server logs for signs of cryptomining activity, such as high CPU usage during off-hours. Once the vendor provides an update for any exploited vulnerabilities, it should be applied immediately.

What to do and how to stay safe: PoeLLM

• Audit exposed AI services and open-source tools for unauthorized access or misconfigurations.
• Monitor network traffic for unusual connections to GitHub or other unexpected external domains.
• Review server logs for signs of cryptomining activity, such as sustained high CPU usage.
• Ensure that all public-facing services are properly authenticated and access-controlled.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the name of the malware involved in this campaign?

The malware is dubbed PoeLLM, and the campaign is called Canto Incognito.

How does the malware locate its command-and-control servers?

It extracts the C2 addresses from a poem posted on GitHub.

How many servers have been infected so far?

Black Lotus Labs reports that over 3,400 servers have been infected.