3,400 Self-Hosted Servers Were Secretly Mining Crypto. The Command Server Was a Poem.

In April, while homelab owners were busy benchmarking local models, somebody was quietly turning thousands of self-hosted servers into a cryptomining botnet. Researchers at Lumen's Black Lotus Labs have now published the full picture: a campaign they call Canto Incognito infected more than 3,400 internet-facing servers, using a custom Linux malware strain named PoeLLM to mine cryptocurrency and recruit machines into a self-expanding botnet. The instructions for all of it came from a poem posted on GitHub.

The victims were the backbone of the do-it-yourself AI boom: LiteLLM gateways, Ollama model servers, the document-conversion tool Gotenberg, the code platform Gitea, and Ivanti Sentry gateways. Most sat in the United States and Western Europe, and many ran on machines with serious GPUs, exactly the hardware that makes mining pay. Activity peaked in mid-June, when researchers observed about 2,200 compromised servers, more than 800 of them active on a single day.

How the attack worked

PoeLLM is an ELF binary disguised as libgcrypt, a common system library. Once inside, it deploys XMRig and Iron cryptocurrency miners pointed at Kryptex, a Russian mining service, and turns the machine into a scanner and exploit server that hunts for more exposed services. The compromised service keeps working, so an Ollama server can keep answering prompts while quietly burning your electricity for someone else's profit.

The entry points were not exotic. The attackers targeted exposed, internet-facing deployments, machines reachable from the public internet without adequate hardening. Coverage of the research suggests an April 2026 LiteLLM fix closed the route the malware used, but plenty of servers were never patched. "Compromised hosts are reused to expand the botnet," the Black Lotus Labs researchers said in a report shared with The Hacker News. Infected machines scan and exploit onward, which is how one weekend project becomes a doorway into the rest of your network.

The entry points were not exotic. They were just servers left facing the public internet, unpatched and unguarded.

The poem that hid a botnet

The strangest part is the command-and-control mechanism. PoeLLM does not hard-code an IP address. It fetches a file called dash.css from a GitHub repository under the account "ejejejdfbbebe" that poses as a fork of the official Node.js site (investigators found no actual connection to Node.js), and reads a two-stanza poem titled "On the Nature of Connection." Four specific words at fixed positions in the verse are matched through a dictionary hard-coded into the malware, and the four resulting numbers form an IPv4 address. In one version of the poem, the words driver, diode, decryption, and string produced 92.119.165.74.

When the operators want a new command server, they just edit the poem. Black Lotus Labs watched the verse change 11 times after the first commit on April 13, each revision quietly shifting the whole botnet to new infrastructure. No new malware needs pushing, and there is no domain for defenders to seize, just different words in a poem. Despite the AI flavor, this is not a prompt injection or jailbreak: the poem is an obfuscated configuration file, a trick that defeats static string analysis rather than any model's safety filters.

Why the DIY AI stack was the target

This is one of the first large-scale cryptomining operations aimed directly at the self-hosted AI boom. Solo developers, consultants, and small shops increasingly run LiteLLM to route requests across models or Ollama to keep client data on their own hardware. These setups often start as weekend experiments and quietly become part of real work, without the hardening a company IT team would apply.

AI boxes are attractive because of the GPUs. The researchers describe the campaign as financially motivated: the miners connected to a Russian crypto-mining service, while malware comments and the attacker's GitHub pages are in Italian and network data suggests the operator is located in Italy. The researchers even believe the poem itself was written by AI, which is fitting in a way the victims will not find funny. Lumen says it has blocked traffic to and from the PoeLLM control servers, but the deeper lesson is that the models were never the weak point. It was the exposed infrastructure around them.

How to check your own stack

If you self-host any of the named tools, the response is straightforward. Bring LiteLLM current past the April 2026 fixes, and update everything else you run. Do not expose AI endpoints or admin panels directly to the internet; put them behind authentication on a reverse proxy, or reach them through a private tunnel like Tailscale or WireGuard instead of opening router ports. Watch for the warning signs: unexplained CPU or GPU load, processes you do not recognize, or a power bill that suddenly stops making sense. The self-hosting creed is that your data stays yours. Canto Incognito is a reminder that your compute is yours too, and that leaving it facing the internet unguarded is an invitation to whoever is reading the poetry.