Ankura CTIX FLASH Update – October 9, 2026

Malware Activity

PoeLLM Botnet Turns Exposed AI/LLM Servers into Cryptomining Launchpads

A financially motivated campaign dubbed Canto Incognito is targeting exposed AI and LLM infrastructure with a new malware family called PoeLLM, turning compromised servers into cryptomining nodes, scanners, and exploit launchpads. Lumen Black Lotus Labs reports more than 3,400 victim servers, mostly in the US and Western Europe, with peaks of approximately 800 active systems per day. PoeLLM (an ELF binary masquerading as libgcrypt) uses a creative command-and-control (C2) mechanism that reads four (4) keywords from a poem (“On the Nature of Connection”) in a dash.css file on a GitHub repo, maps them via a hard‑coded dictionary to an IPv4 address, and thus derives the C2. Each time the operator changes the poem, the botnet points to a new C2, with at least eleven (11) having been used so far. The malware deploys XMRig and Iron miners, provides remote shell access, scans HTTP/S, and exploits