In mid-April 2026, the operator behind the GitHub account 'ejejejdfbbebe' made an initial commit containing an adversarial poem. The poem, called 'On the Nature of Connection', appeared as a file named 'dash.css' within a fork of the nodejs.org source code.
Its purpose was more practical than literary. Attackers had placed malware installation commands inside poems on GitHub. PoeLLM was built to pick out four marked words and run them through a hard-coded dictionary, producing the four octets of an IPv4 command-and-control address.
That method let the malware find the infrastructure directing it without keeping the address plainly visible in its own code. The poem has been revised eleven times since its first GitHub commit on 13 April 2026. Each edit could shift the operator's infrastructure without requiring a change to the malware binaries.
Lumen's Black Lotus Labs identified the malware, calling it PoeLLM and naming the wider operation Canto Incognito. The campaign has been active since at least April 2026.
The malware goes after exposed LiteLLM, Ollama, Gotenberg and Gitea services. It also targets Ivanti Sentry, where CVE-2026-10520 provides initial access. One LiteLLM route is associated with the command-injection flaw CVE-2026-42271.
Once a server is compromised, the Linux payload can provide a remote shell, scan for targets, deliver exploits and install XMRig and Iron miners. Compromised machines have run XMRig and Iron mining software connected to Kryptex mining pools, while also being used as vulnerability scanners and exploit servers.
The campaign reached over 800 active infections per day at its peak. More than 3,000 servers have been infected since April 2026, with most affected machines in the United States and Western Europe.
Researchers attribute the operator to an Italian-speaking individual, citing Italian-language comments found in the malware code.
Comments (0)