PoeLLM and Canto Incognito: What the 3,400-Server Campaign Actually Shows

Direct answer

PoeLLM is the malware; Canto Incognito is the campaign. Lumen says the operation compromised more than 3,400 victim servers cumulatively while using exposed LiteLLM, Ollama, Gotenberg and Gitea deployments for cryptocurrency mining and further scanning. The figure is not 3,400 organizations, not a daily total, and not proof that every server ran the same exploit. The poem helped infected systems calculate changing C2 locations.

What happened, and when?

Black Lotus Labs says the earliest evidence of the campaign dates to April 2026. Its IOC record begins with C2 infrastructure first observed on April 13, while Lumen describes broader scanning and exploitation as beginning in May. Researchers encountered the infrastructure in June during an investigation involving an Ivanti Sentry device. That discovery exposed a larger operation involving AI services, document-conversion software and developer tooling.

The new event on October 7 was therefore the public research disclosure, not the start of the intrusion campaign. CyberScoop independently reported the same day that Black Lotus Labs had found more than 3,400 compromised servers since April. Its reporting also says that what the operator has achieved beyond scanning and cryptocurrency mining remains under investigation. (Source label: CyberScoop, October 7, 2026.)

This timing matters for defenders. A server that appears quiet on October 8 may still have been used earlier as a scanner or mining host. Conversely, an internet-facing service that matches the product profile is not automatically an infected host. Exposure is a reason to investigate and reduce reachability, not a diagnosis.

PoeLLM and Canto Incognito are not interchangeable names

The names describe different things:

Using the names precisely prevents two common errors. Calling the entire campaign “PoeLLM” can make a count of observed victim servers sound like a count of malware samples. Calling the malware “Canto Incognito” can make the campaign label look like a confirmed criminal group. Neither interpretation is supported by the sources.

The campaign also should not be reduced to “an AI breach.” Lumen's telemetry associated many victims with AI or open-source services, but it also identified Gotenberg and Gitea servers and possible targeting of other software. The evidence describes a broad exposed-service operation with a strong AI-infrastructure concentration, not a universal flaw in every AI deployment.

• PoeLLM is the malware family name used by Black Lotus Labs. The sample described by Lumen contains remote-shell capability, mining components and code for HTTP/S scanning and exploit deployment.
• Canto Incognito is the campaign label. It covers the wider activity: infrastructure, victim servers, mining, scanning, exploitation and the changing C2 system.

How the poem becomes a changing C2 lookup

The GitHub-hosted poem is not described as a payload download or an executable. Instead, the malware retrieves text from the repository, selects words in positions relative to fixed anchors, and maps four extracted words through a hard-coded dictionary inside the malware. The resulting values form the current C2 address.

CyberScoop reported that the relevant poem words had changed at least a dozen times. If the operator edits the poem, infected systems can calculate a different C2 location without receiving a new malware binary. This gives the operator an inexpensive way to rotate infrastructure and makes the poem look harmless when viewed without the code that knows how to interpret it.

That is a resilience technique, not magic and not proof that GitHub itself was compromised. The public repository served as a lookup source in the described design. A network defender should therefore consider both endpoint behavior and outbound retrieval of unusual public text, while avoiding the simplistic rule that access to a legitimate code-hosting service equals infection.

Which exposed services were in the investigation?

Lumen identified four recurring service families in its victim telemetry:

The report also discusses possible targeting of Ivanti Sentry, based on how Black Lotus Labs first encountered the infrastructure. That does not establish one universal entry path for all victims. The sources do not provide a single affected product version that can be safely presented as the campaign's answer.

The practical commonality is exposure. Services that should be reachable only from a controlled application tier, VPN or administrative network can become discoverable when published directly to the internet. Lumen specifically notes that Gotenberg's installation guidance warns against direct internet exposure. A public banner or open port is not the same as a confirmed compromise, but it increases the need for patching, authentication, segmentation and monitoring.

• LiteLLM, an open-source layer used to route or manage large-language-model requests.
• Ollama, used to run models locally or on self-managed infrastructure.
• Gotenberg, an open-source document and PDF conversion service.
• Gitea, a self-hosted development and source-control platform.

What the malware did after a foothold

The campaign appears financially motivated. Lumen identified mining components associated with XMRig and Iron and observed victim systems connecting to Kryptex mining infrastructure. That makes resource consumption a central impact: CPU or GPU capacity can be diverted, workloads can slow, and cloud costs can rise.

Mining was only one role. Infected servers were also used to scan for additional vulnerable systems and to proxy exploitation attempts. The operation therefore had a multiplier effect: one compromised server could help locate or reach another exposed service. Lumen observed traffic aimed at ports associated with Gotenberg and LiteLLM, and later traffic toward SSH and other login portals. The research says the maturity of that distributed brute-force capability remained uncertain.

CyberScoop reported that the malware could allow remote command execution and potentially abuse AI models, but also stressed that the operator's achievements beyond scanning and cryptomining were still being investigated. It would be inaccurate to turn that capability into a claim that the campaign stole a particular company's data, abused a named model or conducted confirmed lateral movement.

How to read the 3,400, 2,200 and 800 figures

The numbers measure different things and must not be added together.

Lumen's October report says the campaign impacted more than 3,400 victim servers over the campaign. It also describes an earlier period in which the operation involved almost 2,200 affected servers, with nearly 800 active on a peak day. The earlier snapshot and daily-active figure overlap with the cumulative campaign total; they are not extra victims.

“Servers” should also remain “servers.” The figure does not establish 3,400 unique companies, organizations or people. One organization may operate many exposed systems, a changing IP may represent the same host at different times, and telemetry-based identification has limits. The sources do not provide a verified organization count.

The IOC file is a useful date-stamped companion to the research. Its October 7, 2026 record lists 12 C2 IP addresses with observation ranges and marks three as present at that time. Those observations help defenders compare historical network data, but an IOC list is not a complete verdict: absence from the list does not prove safety, and a connection to an indicator needs context from the host and timeframe.

What attribution does—and does not—say

Black Lotus Labs assesses that the operation is associated with an Italian-speaking threat actor. The assessment is based on details such as Italian comments in malware code and use of Italy-based infrastructure for testing or C2, according to the independent report. It is not a confirmed identity, nationality or named group attribution.

CyberScoop says researchers did not know how many people were involved and had not observed connections to other groups or campaigns. That is an important limit. Language clues and infrastructure geography can support an assessment, but they do not establish who operated the campaign or where that person was located.

There is likewise no basis in these sources for assigning a universal exploit path. The research links different observed behaviors to different exposed products and says the campaign used vulnerable internet-facing services. A defender should investigate the actual service, version, logs and process activity rather than assume that every affected host entered through one CVE or one request path.

FAQs

Question: Is every internet-facing LiteLLM or Ollama server infected?

No. The campaign targeted exposed services, but the evidence does not establish that every deployment was compromised or that all victims entered through the same weakness. Exposure should trigger an inventory, patch and log review. Confirm infection through host and network evidence rather than product name alone.

Question: Does the 3,400 figure mean 3,400 organizations were breached?

No. Lumen's figure is a cumulative count of more than 3,400 victim servers observed over the campaign. It is not a verified unique-organization total. The nearly 2,200-server earlier snapshot and nearly 800 daily-active peak are overlapping measures and should not be added to it.

Limitations and editorial notes

This article reflects the Lumen/Black Lotus Labs research dated October 7, 2026, the Black Lotus Labs IOC record marked “present” on that date, and CyberScoop's October 7 independent reporting. Lumen's page does not provide a reliable clock time, so no precise publication hour is asserted. The campaign timeline begins in April 2026, with broader scanning and exploitation described in May and infrastructure discovery in June.

The evidence is largely network telemetry, malware analysis and reporting about the investigator's findings. It does not provide a complete victim list, a unique-organization count, a definitive actor identity, a universal exploit path or proof of data theft from named victims. Product exposure, suspected exploitation, malware execution, mining activity and downstream compromise are separate questions. Before publication, editors should recheck the live IOC record and any vendor advisories for changes to indicators or affected product versions.

Decision checklist

• Inventory internet exposure. List every public listener and hostname for LiteLLM, Ollama, Gotenberg, Gitea, model-serving endpoints, management panels and related gateways. Include cloud instances and temporary test deployments.
• Remove unnecessary reachability. Put internal services behind a firewall, private network, VPN or authenticated gateway. Restrict administrative interfaces and service ports to the smallest required source range.
• Patch from authoritative release guidance. Confirm the deployed product and version, review vendor or maintainer advisories, and update unsupported or abandoned images. Do not infer that a product is safe merely because it is not named in the report.
• Review network telemetry. Look for unexpected outbound connections from AI, document-conversion and development servers, especially to listed C2 indicators, mining infrastructure or unusual SSH targets. Compare dates with the IOC observation windows.
• Check resource anomalies. Investigate unexplained CPU/GPU saturation, new miner-like processes, altered container commands, unfamiliar scheduled jobs, new users and unexpected outbound scanning.
• Treat a suspected host as exposed. Isolate it from the network where operationally safe, preserve logs and volatile evidence, and rotate credentials or tokens from a clean administrative system. Rebuild from trusted images when persistence or command execution cannot be ruled out.
• Review downstream risk. Determine whether the server held model credentials, API tokens, source code, documents, customer data or access to other internal systems. Mining may be the visible symptom rather than the full impact.
• Keep monitoring after cleanup. Because the C2 lookup can change and compromised servers can be reused as scanners, continue watching egress, service exposure and authentication events after remediation.

Limitations

• Evidence was reviewed on 8 October 2026; advisories, telemetry and package status can change.
• General defensive guidance is not a diagnosis of a particular system or a guarantee of complete cleanup.
• Capabilities, exposure and sensor attempts do not alone establish confirmed data theft or a customer breach.
• Source guidance and indicators must be rechecked before making operational decisions.

Evidence sources

1. Lumen / Black Lotus Labs — Lumen / Black Lotus Labs — Original malware and network investigation
2. First-party researcher/project repository — First-party researcher/project repository — Project issue or investigator IOC record
3. CyberScoop — CyberScoop — Independent interview and report