If you self-host, do this first
From outside your network, check whether anything answers on port 4000 (LiteLLM), port 3000 (Gotenberg) or your Ollama port.
If something answers, it should not be there. Put it behind a firewall or a VPN today.
Then check outbound connections against the addresses listed further down this page.
What happened
Lumen Technologies' Black Lotus Labs published research into a cryptomining campaign it tracks as Canto Incognito, spreading malware it named PoeLLM.
The operator scanned the internet for exposed AI and developer services, compromised them, and installed cryptocurrency miners. Compromised machines were then turned into scanners themselves, hunting for the next victim.
On the victim count, the research is inconsistent. Lumen's body text says almost 2,200 victims; its own key takeaways say more than 3,400. The post does not reconcile the two. Either way the campaign is substantial, and either way you should check your own servers rather than reasoning about the total.
Why AI servers specifically
This campaign targets self-hosted AI infrastructure deliberately, and the logic is uncomfortable once you see it.
- They run on GPUs. A cryptominer wants exactly the hardware you bought to run models.
- They hold credentials. API keys to paid services, often with no spend limit set.
- They are frequently exposed. Self-hosting guides optimise for "it works", and binding to 0.0.0.0 is the fastest way to get there.
- They are new. LiteLLM and Ollama are not in most organisations' patch cycles or asset inventories.
Lumen notes the compromise outcomes go beyond mining: token abuse, data loss, "LLM jacking" where your paid API access is resold, and lateral movement into the rest of your network.
How it gets in
The operator scans for services on port 4000 (LiteLLM) and port 3000 (Gotenberg). On finding one, it sends a crafted POST request instructing the service to download a payload from a server on port 81.
For LiteLLM the likely path is the /mcp-rest/test/connection endpoint, referenced in CVE-2026-42271, a command injection flaw. Lumen does not name the affected LiteLLM versions, so patch to current rather than trying to reason about whether yours is safe.
Gitea and Ivanti Sentry instances were also affected. Lumen ties Ivanti Sentry to CVE-2026-10520 as the starting point of the investigation but does not confirm it as an infection vector.
On Ollama specifically: Lumen says most victims ran LiteLLM or Ollama, but names no CVE, version or port for Ollama. The honest reading is that exposed Ollama instances were compromised without the research publishing how. Treat an internet-facing Ollama as at risk regardless.
The poem
The cleverest part of this campaign is how the malware finds its command server.
The operator hosts a poem on GitHub, in a fork of an unrelated Node.js project, in a file called dash.css that has nothing to do with CSS. The malware extracts four words from fixed positions in the poem, maps each through a hard-coded dictionary to a number, and assembles those four numbers into an IPv4 address.
Lumen's worked example: the words driver, diode, decryption and string map to 92, 119, 165 and 74 — producing the address 92.119.165.74.
Why it works. The operator changed the poem eleven times between 13 April and September 2026, altering only those four words. Every infected machine moved to a new command server each time, and the malware binary never changed. A GitHub file of poetry is not what a network defender is watching, and takedowns aimed at the malware miss the mechanism entirely.
Indicators of compromise
Search your outbound connection logs for these. Lumen listed them as active at publication.
92.119.164.50 — first seen 23 July 2026103.249.201.108 — first seen 13 August 2026178.128.14.204 — first seen 16 June 2026
Other addresses in the set: 191.37.28.160, 89.39.253.46, 120.224.114.212, 5.78.73.122, 15.204.178.28, 92.119.165.74, 45.133.73.28, 185.132.53.158, 136.148.69.233.
Other signals:
- Beaconing on ports 3778, 5001, 5002 or 9999.
- Mining traffic to
5.180.174.162:8029 or 46.21.245.211:7029.
- An ELF binary named libgcrypt that is not your system's real libgcrypt. It carries a remote shell, the Iron and XMRig miners, and scanning code.
- Requests to
/private/python3.6 or /private/bins.sh on port 81.
Black Lotus Labs publishes the full list in its IOC repository on GitHub.
What to do
1. Get them off the internet. LiteLLM, Ollama and Gotenberg should never be directly reachable. Firewall, VPN or an authenticated reverse proxy — not a public port.
2. Patch now, not on your next cycle. And add these tools to the cycle. The reason this campaign worked is that AI tooling sits outside most patch processes.
3. Check outbound traffic against the addresses above. Mining traffic is persistent and unusual — it stands out in logs if you look.
4. Rotate every API key that touched an exposed server. If it was compromised, assume the keys left with it.
5. Audit exposure after every install. Scan your own public IP from outside. New AI tools default to convenient, not safe.
The part worth remembering
Peak activity was roughly 800 active servers a day in mid-June. Victims were concentrated in the US and Western Europe. Lumen assesses with moderate confidence that the operator is Italian-speaking.
But the number that should change your behaviour is none of those. It is that the entire campaign depended on people running AI tools on public IPs without meaning to. Every self-hosting tutorial that tells you to bind to 0.0.0.0 and skip authentication "for now" is writing the next entry in this list.
FAQ
Is my Ollama install affected?
Only if it is reachable from the internet. Ollama bound to localhost and used from the same machine is not exposed. Check by scanning your public IP from outside your network, not from the machine itself.
Which LiteLLM versions are vulnerable?
Lumen does not name versions. The likely path is CVE-2026-42271, a command injection flaw in the /mcp-rest/test/connection endpoint. Update to the current release rather than trying to determine whether yours is affected.
How do I know if I was compromised?
Check outbound connections against the IP addresses listed above, look for beaconing on ports 3778, 5001, 5002 or 9999, and look for an ELF binary named libgcrypt that is not the real one. Unexplained sustained GPU load is another signal.
What is the poem actually for?
It encodes the command server's IP address. Changing four words in the poem moves every infected machine to a new server without updating the malware, which makes the infrastructure hard to disrupt.
How many servers were hit?
Lumen's report gives two different figures — around 2,200 in the body and more than 3,400 in the key takeaways — and does not reconcile them.
Is this still active?
The campaign ran from April 2026 with command servers still listed as active at the time Lumen published. The underlying exposure — AI services on public IPs — has not gone away, which is the part that matters for you.