A Botnet Hid Its Command Server in a GitHub Poem — and Turned 3,400 Exposed AI Servers Into Mining Proxies

On October 7, 2026, Lumen Technologies' Black Lotus Labs published research into a financially motivated botnet campaign it tracks as Canto Incognito, whose malware it named PoeLLM. The campaign has compromised more than 3,400 internet-facing servers since at least April 2026, concentrated in the United States and Western Europe, according to the researchers — and the victims are not random machines. Lumen says they are predominantly vulnerable deployments of LiteLLM and Ollama, plus hundreds of servers running the Gotenberg PDF converter and the Gitea development toolkit, with Ivanti Sentry appliances also in scope. Once infected, those servers were mined for cryptocurrency and repurposed as scanners and exploit servers — what Black Lotus Labs' Ryan English, in an interview with CyberScoop, called "a private army of AI-enabled proxies." The same vendor report was shared with The Hacker News, which published its own account the same day.

The detail that makes this record worth reading is not the scale. It is the command-and-control design: there is no hardcoded domain and no fallback IP in the malware. The address of the current C2 server is computed at runtime from four words taken out of a poem hosted in a public GitHub repository. Edit the poem, and the whole botnet moves.

What was actually compromised

The victims, per Lumen's report, are enterprise AI and developer services that were reachable from the internet: LiteLLM and Ollama deployments, hundreds of Gotenberg PDF-conversion servers, and Gitea. Lumen's researchers assessed that the campaign also touched Ivanti Sentry. The primary scanning objectives were ports 3000 and 4000, the default listening ports for Gotenberg and LiteLLM respectively.

Two vulnerabilities matter for how the machines were reached, and the report is careful about both:

• Ivanti Sentry, CVE-2026-10520. Lumen says its researchers first encountered the PoeLLM infrastructure while investigating this flaw in Ivanti's secure mobile gateway. In early June 2026, a compromised Ivanti Sentry victim contacted a dedicated server at 5.78.73[.]122 and shortly afterwards began scanning for other vulnerable devices. Note the hedge: Lumen's own key-takeaways list says the campaign has "possible targeting of Ivanti Sentry," while the body of the same report describes the appliance as a live victim. That internal discrepancy is in the primary source.

• LiteLLM, CVE-2026-42271. One PoeLLM sample that Lumen examined targeted the LiteLLM endpoint "/mcp-rest/test/connection," which Lumen says "was likely the exploitation path" for a LiteLLM command injection vulnerability identified as CVE-2026-42271. CyberScoop's report describes the same entry point as a maximum-severity defect in Ivanti Sentry without naming a CVE, and does not cover the LiteLLM flaw; The Hacker News names neither CVE. The LiteLLM MCP endpoint flaw is the one this archive recorded earlier in 2026, before this campaign was documented.

What the stolen access bought the operator was compute and data. "Exposed AI/LLM services are valuable not only because of software vulnerabilities, but also because they may contain useful data and run on powerful hardware suitable for mining," Lumen wrote. English told CyberScoop the malware also carries remote code execution functionality that could let an operator abuse the AI models running on victim servers — stated as a capability, not an observed outcome.

The poem that is also a lookup table

The GitHub account in question is "ejejejdfbbebe," and the repository is a fork of the nodejs.org website source that has no apparent connection to Node.js itself. Inside it, in a file named "dash.css" — a filename that does not exist in the original repository — the operator placed a two-stanza poem titled "On the Nature of Connection." Lumen counted 11 updates to it since the first commit on April 13, 2026; CyberScoop reports the wording has been changed "at least a dozen times."

As captured by Lumen in September 2026, the first stanza read: "In the silent hum of driver, the machines begin to speak, each pulse of diode threading light through copper veins. We taught the dark to carry meaning, byte by byte — a language built from lightning, cold and clean." The second stanza includes the line "Beyond the wall of encryption, a signal finds its way, the tick of distant servers answers back."

The extraction is mechanical. A function Lumen calls extract_poem_phrase_field pulls three phrases from fixed positions in the verse — the text between "In the silent hum of " and the following comma, between "each pulse of " and " threading," and between "Beyond the wall of " and the next comma. A fourth word is recovered differently, by searching for the string "of distant servers," walking back to the previous whitespace, checking that the four preceding bytes spell "the ", and taking the word after it. Each of the four words is then matched against a hard-coded dictionary compiled into the binary, and the four resulting numbers are concatenated into an IPv4 address. In a sample Lumen recovered on June 23, 2026, "driver" mapped to 92, "diode" to 119, "decryption" to 165 and "string" to 74 — giving 92.119.165[.]74.

Because only the four keywords ever changed across the 11 observed revisions, and the decoding pattern never did, moving the botnet cost the operator a handful of edits to a public text file. "The most interesting piece of the poem approach is that the IP address used for C2 communications is invisible outside of the victim's netflow," English told CyberScoop. "To anyone who comes across it, this is simply a poem on GitHub. It has no links, no files to download, no encrypted text that could easily be flagged as malicious, even by advanced models. There would be no reason for any security researcher to identify this poem as malicious — or know about the IP address hidden within it — unless they had access to the malware referencing it."

Lumen says it believes the poem was probably written by an AI, and labels that as an inference, not a finding. The reasoning, in English's words to The Hacker News: the poem would have worked in any language, yet the actor's own preference appears to be Italian. It is a judgement about writing style, not forensic attribution of the text to a model.

What the malware does once it lands

The payload Lumen analysed is an ELF file distributed under the name "libgcrypt," with the SHA-256 hash 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501. Per Lumen's analysis it bundles a remote shell, the Iron and XMRig cryptocurrency miners, HTTP and HTTPS scanning capability, and exploit deployment against vulnerable targets.

Infected hosts beacon back to one of several C2 ports — 3778, 5001, 5002 or 9999 — and are instructed to download further files from port 81 on the C2 server (paths observed included /private/python3.6 and /private/bins.sh). Mining payouts route to the Russian mining service Kryptex: Lumen observed victims contacting 5.180.174[.]162:8029 and 46.21.245[.]211:7029, which hosts edge-ru-07[.]kryptex[.]network. The first 900 victims' most common shared trait, after contact with the initial C2, was contact with that Kryptex endpoint.

The botnet also grows itself. Compromised servers were turned into scanners and exploit servers: an exploit server sends a crafted HTTP POST to an exposed service on a newly found target, instructing it to download the malware from the C2. More recently, Lumen saw pools of victims targeting SSH ports and other login portals, which it reads as possible experimentation with a distributed brute-force framework. Lumen explicitly qualifies that as immature and unproven: many of the targets were dedicated servers in Italy, and the researchers assess the capability "may have been in the early stages of development."

The timeline, and the two numbers that do not match

The campaign's first decoded C2 was 191.37.28[.]160, a Brazilian router with an exposed Boa web server on port 2222 that was vulnerable to CVE-2018-21027 and CVE-2018-21028 — though Lumen found no direct evidence those flaws were the entry path. Roughly an hour after the first GitHub commit, that C2 contacted a server in Italy at 57.131.5[.]211:80 hosting the domain malwarescan[.]xyz, which had been registered in February 2026. Lumen says it saw no other notable traffic to that domain's API endpoint and assesses the domain may be owned by the PoeLLM operator. A May revision moved the C2 to 120.224.114[.]212, geolocated to China and, like the Brazilian host, running a vulnerable Boa web server with a router admin page. In all, Lumen identified 12 C2 IP addresses; three were still active at publication — 92.119.164.50 (first seen July 23, 2026), 103.249.201.108 (first seen August 13, 2026) and 178.128.14.204 (first seen June 16, 2026).

Lumen also names a suspected management server: 185.119.19[.]171 in Italy, previously hosting Prometheus and Uptime Kuma monitoring dashboards, which several C2s contacted. The report states this attribution at moderate confidence.

On scale, the primary source contains two figures that do not obviously reconcile, and both are worth stating. Lumen's key takeaways say PoeLLM "has impacted more than 3,400 victim servers." A body paragraph in the same report says the campaign "has impacted almost 2,200 victim servers," and Lumen separately describes the peak of operations in mid-June as involving almost 2,200 affected servers with nearly 800 active per day. The Hacker News reads the numbers as the running total (3,400-plus) plus the mid-June peak (almost 2,200, nearly 800 daily). Which of the two Lumen figures is the cumulative victim count is not made explicit in the report itself.

Established, assessed, and still unknown

It is worth separating three kinds of claim in this record, because the archive's confidence grade covers the documentation, not every inference inside it.

• Established from the malware itself: the poem-based C2 mechanism, the extraction function and dictionary, the payload's capabilities (remote shell, Iron and XMRig miners, scanning, exploit deployment), the C2 IP list, beacon ports, and the Kryptex endpoints. These come from artefact analysis and netflow, and they are the bulk of the report.

• Assessed at a stated confidence level: attribution to an Italian-speaking threat actor, at moderate confidence, based on Italian-language comments in the malware and on the actor's GitHub pages plus netflow indicators pointing to Italy. The Italian server 185.119.19[.]171 as the botnet's administrative interface, also at moderate confidence. The LiteLLM endpoint as the "likely" exploitation path. The claim that the poem was probably AI-written — an inference from language preference, not a technical finding.

• Open or unconfirmed: how many people operate the campaign (unknown), whether it links to any other group or campaign (none observed), whether the Ivanti Sentry appliance was an exploited entry point or incidental (hedged in the key takeaways, described as a victim in the body), and how mature the distributed brute-force capability is. Lumen says the operator's achievements beyond scanning and cryptomining remain under investigation.

Independent corroboration exists for the reporting, but not for the telemetry behind it. CyberScoop and The Hacker News both published their own accounts on October 7, 2026, with independent interviews with Black Lotus Labs, and their details — the 3,400-plus figure, the poem mechanism, the Italian-language attribution, the Kryptex link — align with the vendor report. Both, however, trace to the same primary research. As of October 10, 2026, no second research organisation or regulator has published an independent analysis of PoeLLM, so nothing here should be read as reproduced by a party other than Lumen.

What changed after disclosure

The most consequential response did not come from a patch. The GitHub repository staging the poem "is no longer accessible," a development Lumen says "completely disrupts the campaign." English told The Hacker News: "We think that was his only repo, and it's been disrupted fully." Lumen had notified GitHub, and it null-routed the actor's previous and active C2 servers, a change English said took effect early on the Tuesday night before publication. The cause of the repository's removal is unconfirmed — English told The Hacker News it "could be they flagged it for abuse or the actor folded up shop and went quiet on that platform." Because the C2 was derived rather than hardcoded, removing the lookup table removes the botnet's ability to find its own infrastructure.

Lumen says it blocked all traffic to and from the PoeLLM C2 servers during the investigation and that Lumen Defender customers were protected from those servers from discovery onward. Its published guidance for defenders is routine hygiene applied to an unusual target set: check network logs against the indicators of compromise it published on its own GitHub repository, audit external exposure after installing open-source tooling, restrict service ports as far as possible, keep routers, firewalls and IoT devices patched and rebooted, and bring AI services inside attack-surface management. It also points at the Gotenberg installation guide, which already warns users not to expose the service to the internet — a warning the hundreds of compromised Gotenberg servers evidently predate.

Nothing in the record suggests a technical fix for the traffic pattern itself: the poem was not a vulnerability in GitHub, Node.js, LiteLLM or Ollama. It was a public text file whose only meaning lived inside a binary that very few people had.

Why this is an AI-incident record

The archive files this as an incident with confirmed AI involvement, tagged INFRA and WEAPON, severity high, with real harm recorded — and the harm is concrete rather than speculative: thousands of internet-facing servers whose compute was stolen and whose access was repurposed, in a campaign that Lumen describes as financially motivated rather than directed at the models themselves. The AI element is the target selection. Servers running LLM gateways and local model runtimes are self-hosted, frequently internet-exposed, often installed without a patch cycle, and sit on hardware that mines efficiently. Lumen's own framing is that AI infrastructure is becoming an attractive target precisely because of that combination — exposed services with known vulnerabilities, useful data and fast, power-hungry hardware.

The weapon angle is the C2 design, and it generalises past this campaign. A hardcoded domain or IP can be blocked, sinkholed, or used to fingerprint malware. A derived address whose only artefact is a harmless-looking public document cannot, unless an analyst has the binary. English's point to CyberScoop — that many of the campaign's C2s never appeared on crowd-sourced security tooling — is the measure of how well that worked.

Because the disruption rests on a single repository rather than on a patched flaw, the campaign's status after October 7 is genuinely uncertain rather than closed: Lumen says the repository's loss "completely disrupts" it, and separately says three C2 servers were still active at publication. Lumen publishes its own indicators of compromise on a GitHub repository of its own, and the record's severity, confidence grade and recorded harm are the archive's, not the vendor's.

This is one record. The rest of it — the other disclosures, their severity and confidence grades, and what defenders actually did about them — the AI incident archive indexes each one against its primary sources, so a campaign like this can be read alongside the incidents that came before it rather than in isolation.