OTX Threat: Canto incognito: tracking the PoeLLM malware

Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual command-and-control mechanism where infected systems derive C2 server addresses from keywords embedded in a poem hosted on GitHub. This financially-motivated operation deploys XMR CVEs: CVE-2018-21027, CVE-2026-42271, CVE-2026-10520, CVE-2018-21028 Sectors: Technology