OTX-6ac7794a227de27b373a9281
info
📛 Threat Title
Canto incognito: tracking the PoeLLM malware
Description
Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual command-and-control mechanism where infected systems derive C2 server addresses from keywords embedded in a poem hosted on GitHub. This financially-motivated operation deploys XMRig and Iron cryptocurrency miners, connecting victims to Kryptex mining infrastructure. Compromised hosts are repurposed as scanners and exploit servers to expand the botnet, which has impacted over 3,400 victim servers with peak activity exceeding 800 active servers daily. The campaign appears linked to an Italian-speaking threat actor and predominantly affects victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure. Pulse contains 25 indicator(s) (IOCs). View on OTX to inspect.
Indicators of Compromise (25)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
ipv4
185.132.53.158
VT 7 / 92
2 feeds
IOC database
- Type
- ipv4
- Value
185.132.53.158- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Imported from threat-intel feed: Binarydefense
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Binarydefense, Ipsum. Open in Threat Hunt →
Flagged by 7 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ADMINUSLabs | malicious | malicious |
| BitDefender | malicious | phishing |
| Chong Lua Dao | malicious | malicious |
| G-Data | malicious | phishing |
| AlphaSOC | suspicious | suspicious |
| Gridinsoft | suspicious | suspicious |
| SOCRadar | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 185.132.53.0/24 |
| Country | DE |
| AS owner | Julian Achter |
| ASN | 211507 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-10-08 16:31 UTC |
| Last modified on VirusTotal | 2026-10-08 23:44 UTC |
| WHOIS record date | 2026-09-06 01:04 UTC |
cve
CVE-2026-42271
IOC database
- Type
- cve
- Value
CVE-2026-42271- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- BerriAI LiteLLM Command Injection Vulnerability
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
cve
CVE-2026-10520
IOC database
- Type
- cve
- Value
CVE-2026-10520- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Ivanti Sentry OS Command Injection Vulnerability
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://5.78.73.122:81/private/python3.6
VT 9 / 93
IOC database
- Type
- url
- Value
http://5.78.73.122:81/private/python3.6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://urlhaus.abuse.ch/downloads/text_recent/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 9 of 93 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alphaMountain.ai | malicious | malicious |
| BitDefender | malicious | malware |
| ESET | malicious | malware |
| Forcepoint ThreatSeeker | malicious | malicious |
| G-Data | malicious | malware |
| Lionic | malicious | malware |
| Sophos | malicious | malware |
| Webroot | malicious | malicious |
| AILabs (MONITORAPP) | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Final URL | http://5.78.73.122:81/private/python3.6 |
| Last HTTP status | 200 |
History
| First seen on VirusTotal | 2026-06-08 17:35 UTC |
| Last submission | 2026-10-09 01:04 UTC |
| Last analysis | 2026-10-09 01:04 UTC |
| Last modified on VirusTotal | 2026-10-09 01:09 UTC |
url
http://5.78.73.122:81/private/bins.sh
VT 9 / 93
IOC database
- Type
- url
- Value
http://5.78.73.122:81/private/bins.sh- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://urlhaus.abuse.ch/downloads/text_recent/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 9 of 93 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alphaMountain.ai | malicious | malicious |
| BitDefender | malicious | malware |
| ESET | malicious | malware |
| Forcepoint ThreatSeeker | malicious | malicious |
| G-Data | malicious | malware |
| Lionic | malicious | malware |
| Sophos | malicious | malware |
| Webroot | malicious | malicious |
| AILabs (MONITORAPP) | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Final URL | http://5.78.73.122:81/private/bins.sh |
| Last HTTP status | 200 |
History
| First seen on VirusTotal | 2026-06-13 08:15 UTC |
| Last submission | 2026-10-09 01:04 UTC |
| Last analysis | 2026-10-09 01:04 UTC |
| Last modified on VirusTotal | 2026-10-09 01:09 UTC |
domain
malwarescan.xyz
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/malwarescan.xyz
UrlVoid 1 / 36
IOC database
- Type
- domain
- Value
malwarescan.xyz- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/malwarescan.xyz
cve
CVE-2018-21027
IOC database
- Type
- cve
- Value
CVE-2018-21027- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
ipv4
5.180.174.162
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/ip_addresses/5.180.174.162
IOC database
- Type
- ipv4
- Value
5.180.174.162- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/ip_addresses/5.180.174.162
ipv4
89.39.253.46
VT 6 / 92
IOC database
- Type
- ipv4
- Value
89.39.253.46- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 6 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| BitDefender | malicious | phishing |
| G-Data | malicious | phishing |
| SafeToOpen | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
| Gridinsoft | suspicious | suspicious |
| SOCRadar | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 89.39.253.0/24 |
| Country | RO |
| AS owner | Banat Telecom Satelit S.R.L. |
| ASN | 33977 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-10-08 07:49 UTC |
| Last modified on VirusTotal | 2026-10-08 21:21 UTC |
| WHOIS record date | 2026-08-09 07:37 UTC |
ipv4
92.119.165.74
VT 1 / 92
IOC database
- Type
- ipv4
- Value
92.119.165.74- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ip:port combination that is used for botnet Command&control (C&C) attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alphaMountain.ai | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 92.119.164.0/23 |
| Country | NL |
| AS owner | Julian Achter |
| ASN | 211507 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-10-08 21:34 UTC |
| Last modified on VirusTotal | 2026-10-08 21:35 UTC |
| WHOIS record date | 2026-06-23 17:25 UTC |
ipv4
103.249.201.108
VT 11 / 92
IOC database
- Type
- ipv4
- Value
103.249.201.108- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ip:port combination that is used for botnet Command&control (C&C) attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 11 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| ArcSight Threat Intelligence | malicious | malware |
| CRDF | malicious | malicious |
| Criminal IP | malicious | malicious |
| Emsisoft | malicious | malware |
| Fortinet | malicious | malware |
| MalwareURL | malicious | malware |
| SOCRadar | malicious | malicious |
| Viettel Threat Intelligence | malicious | malicious |
| Webroot | malicious | malicious |
| alphaMountain.ai | suspicious | suspicious |
| Gridinsoft | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 103.249.200.0/23 |
| Country | VN |
| AS owner | THUONGCLOUD COMPANY LIMITED |
| ASN | 150873 |
| Regional registry | APNIC |
History
| Last analysis | 2026-10-19 00:35 UTC |
| Last modified on VirusTotal | 2026-10-19 00:45 UTC |
| WHOIS record date | 2026-10-07 22:43 UTC |
ipv4
136.148.69.233
VT 1 / 92
IOC database
- Type
- ipv4
- Value
136.148.69.233- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ip:port combination that is used for botnet Command&control (C&C) attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 1 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| SOCRadar | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 136.148.69.0/24 |
| Country | IT |
| AS owner | Luigi Labate |
| ASN | 208328 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-10-08 19:01 UTC |
| Last modified on VirusTotal | 2026-10-08 21:05 UTC |
| WHOIS record date | 2026-09-16 20:11 UTC |
ipv4
92.119.164.50
VT 2 / 92
IOC database
- Type
- ipv4
- Value
92.119.164.50- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ip:port combination that is used for botnet Command&control (C&C) attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 2 of 92 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| Seclookup | malicious | malicious |
| SOCRadar | suspicious | suspicious |
Details From VirusTotal
Basic Properties
| Network | 92.119.164.0/23 |
| Country | NL |
| AS owner | Julian Achter |
| ASN | 211507 |
| Regional registry | RIPE NCC |
History
| Last analysis | 2026-10-08 07:47 UTC |
| Last modified on VirusTotal | 2026-10-08 21:37 UTC |
| WHOIS record date | 2026-07-25 01:33 UTC |
ipv4
120.224.114.212
VT 0 / 92
IOC database
- Type
- ipv4
- Value
120.224.114.212- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 120.224.0.0/15 |
| Country | CN |
| AS owner | Shandong Mobile Communication Company Limited |
| ASN | 24444 |
| Regional registry | APNIC |
History
| Last analysis | 2026-10-08 19:04 UTC |
| Last modified on VirusTotal | 2026-10-08 19:05 UTC |
| WHOIS record date | 2026-10-07 22:43 UTC |
ipv4
191.37.28.160
VT 0 / 92
IOC database
- Type
- ipv4
- Value
191.37.28.160- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Network | 191.37.28.0/22 |
| Country | BR |
| AS owner | WRNET LTDA |
| ASN | 263352 |
| Regional registry | LACNIC |
History
| Last analysis | 2026-10-08 19:02 UTC |
| Last modified on VirusTotal | 2026-10-08 19:03 UTC |
| WHOIS record date | 2026-10-07 22:43 UTC |
hash_sha256
6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501
IOC database
- Type
- hash_sha256
- Value
6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501
ipv4
185.119.19.171
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/ip_addresses/185.119.19.171
IOC database
- Type
- ipv4
- Value
185.119.19.171- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/ip_addresses/185.119.19.171
domain
edge-ru-07.kryptex.network
VT 0 / 92
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
edge-ru-07.kryptex.network- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| Registrar | NameCheap, Inc. |
| TLD | network |
History
| Creation date | 2018-08-31 18:42 UTC |
| Last analysis | 2026-10-08 09:34 UTC |
| Last modified on VirusTotal | 2026-10-09 00:45 UTC |
| Last WHOIS update | 2024-08-06 07:35 UTC |
hash_md5
acaf0ec9d31646c2fb59f84f35e6a174
VT 27 / 75
IOC database
- Type
- hash_md5
- Value
acaf0ec9d31646c2fb59f84f35e6a174- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 27 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Miner:Linux/CoinMiner.ASC |
| ALYac | malicious | Trojan.Linux.CoinMiner |
| Arcabit | malicious | Application.Generic.D23534ED |
| Avast | malicious | ELF:Miner-RZ [Trj] |
| AVG | malicious | ELF:Miner-RZ [Trj] |
| Avira | malicious | TR/LINUX.Miner.RZ |
| BitDefender | malicious | Application.Generic.37041389 |
| CTX | malicious | elf.miner.generic |
| Cynet | malicious | Malicious (score: 99) |
| Emsisoft | malicious | Application.Generic.37041389 (B) |
| ESET-NOD32 | malicious | Linux/CoinMiner.ATG trojan |
| F-Secure | malicious | Trojan.TR/LINUX.Miner.RZ |
| Fortinet | malicious | Linux/Miner.ATG!tr |
| GData | malicious | Application.Generic.37041389 |
| malicious | Detected |
|
| huorong | malicious | Trojan/Linux.CoinMiner.bk |
| Kaspersky | malicious | HEUR:Trojan.Linux.Miner.gen |
| Kingsoft | malicious | Linux.Troj.coinminer.v |
| Lionic | malicious | Trojan.Linux.Miner.4!c |
| McAfeeD | malicious | ti!6FAB94577364 |
| Microsoft | malicious | Trojan:Linux/CoinMiner!rfn |
| MicroWorld-eScan | malicious | Application.Generic.37041389 |
| Symantec | malicious | Trojan.Miner!ATN |
| Tencent | malicious | Trojan.Linux.MinerXMRig.lri |
| TrendMicro-HouseCall | malicious | Coinminer.Linux.Gen.TL0101FO26Z0 |
| Varist | malicious | E64/ABMiner.AYPP-1 |
| VIPRE | malicious | Application.Generic.37041389 |
Details From VirusTotal
Basic Properties
| MD5 | acaf0ec9d31646c2fb59f84f35e6a174 |
| SHA-1 | be2ffcc4591e527c48d98a53b66521b93671975e |
| SHA-256 | 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501 |
| VHash | 104eaa4d8195af687608c06d6d35d161 |
| SSDEEP | 98304:3uDyqsvMZBjVHQqfJ5hI+oepQ5ucHCARB4f7TxBMjTXR8Hy+d0I:sVx+PyQ5us4xBMjTXR8Ld0I |
| TLSH | T1F8066D1AF9A224BDC9B5C8308B6FC1757E3174984222793F3588D5702F56E289F2DBE1 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a0c03d8f0bd159ea571ef0e0035dc3b7499caf2c, with debug_info, not stripped |
| File size | 3.5 MB |
History
| First seen on VirusTotal | 2026-06-18 19:32 UTC |
| Last submission | 2026-06-24 20:47 UTC |
| Last analysis | 2026-10-08 17:47 UTC |
| Last modified on VirusTotal | 2026-10-08 19:49 UTC |
Known Names
testclient48219d3bf38e9bc92781030d2c8cfebd48b2a9769e031261a4db4e3a9499244fpython3e2b78ff1a2d78e6f211933adcc522a88ca7d36c0c94d88b74757a8f8574d7749hxxiugt.exeb53ebe2215006f8784d752f8d94555e6ad577774b45afabe167c900bb56e7a45clientlibgcrypt
hash_sha1
be2ffcc4591e527c48d98a53b66521b93671975e
VT 27 / 75
IOC database
- Type
- hash_sha1
- Value
be2ffcc4591e527c48d98a53b66521b93671975e- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 27 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Miner:Linux/CoinMiner.ASC |
| ALYac | malicious | Trojan.Linux.CoinMiner |
| Arcabit | malicious | Application.Generic.D23534ED |
| Avast | malicious | ELF:Miner-RZ [Trj] |
| AVG | malicious | ELF:Miner-RZ [Trj] |
| Avira | malicious | TR/LINUX.Miner.RZ |
| BitDefender | malicious | Application.Generic.37041389 |
| CTX | malicious | elf.miner.generic |
| Cynet | malicious | Malicious (score: 99) |
| Emsisoft | malicious | Application.Generic.37041389 (B) |
| ESET-NOD32 | malicious | Linux/CoinMiner.ATG trojan |
| F-Secure | malicious | Trojan.TR/LINUX.Miner.RZ |
| Fortinet | malicious | Linux/Miner.ATG!tr |
| GData | malicious | Application.Generic.37041389 |
| malicious | Detected |
|
| huorong | malicious | Trojan/Linux.CoinMiner.bk |
| Kaspersky | malicious | HEUR:Trojan.Linux.Miner.gen |
| Kingsoft | malicious | Linux.Troj.coinminer.v |
| Lionic | malicious | Trojan.Linux.Miner.4!c |
| McAfeeD | malicious | ti!6FAB94577364 |
| Microsoft | malicious | Trojan:Linux/CoinMiner!rfn |
| MicroWorld-eScan | malicious | Application.Generic.37041389 |
| Symantec | malicious | Trojan.Miner!ATN |
| Tencent | malicious | Trojan.Linux.MinerXMRig.lri |
| TrendMicro-HouseCall | malicious | Coinminer.Linux.Gen.TL0101FO26Z0 |
| Varist | malicious | E64/ABMiner.AYPP-1 |
| VIPRE | malicious | Application.Generic.37041389 |
Details From VirusTotal
Basic Properties
| MD5 | acaf0ec9d31646c2fb59f84f35e6a174 |
| SHA-1 | be2ffcc4591e527c48d98a53b66521b93671975e |
| SHA-256 | 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501 |
| VHash | 104eaa4d8195af687608c06d6d35d161 |
| SSDEEP | 98304:3uDyqsvMZBjVHQqfJ5hI+oepQ5ucHCARB4f7TxBMjTXR8Hy+d0I:sVx+PyQ5us4xBMjTXR8Ld0I |
| TLSH | T1F8066D1AF9A224BDC9B5C8308B6FC1757E3174984222793F3588D5702F56E289F2DBE1 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a0c03d8f0bd159ea571ef0e0035dc3b7499caf2c, with debug_info, not stripped |
| File size | 3.5 MB |
History
| First seen on VirusTotal | 2026-06-18 19:32 UTC |
| Last submission | 2026-06-24 20:47 UTC |
| Last analysis | 2026-10-08 17:47 UTC |
| Last modified on VirusTotal | 2026-10-08 19:49 UTC |
Known Names
testclient48219d3bf38e9bc92781030d2c8cfebd48b2a9769e031261a4db4e3a9499244fpython3e2b78ff1a2d78e6f211933adcc522a88ca7d36c0c94d88b74757a8f8574d7749hxxiugt.exeb53ebe2215006f8784d752f8d94555e6ad577774b45afabe167c900bb56e7a45clientlibgcrypt
hash_sha256
350a99830b80b5600d3a2757fa996155579ef9d0c53de95f0299f64d280b9bb1
VT 16 / 75
IOC database
- Type
- hash_sha256
- Value
350a99830b80b5600d3a2757fa996155579ef9d0c53de95f0299f64d280b9bb1- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 16 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | Miner:Linux/CoinMiner.ASC |
| Avast | malicious | ELF:Miner-RZ [Trj] |
| AVG | malicious | ELF:Miner-RZ [Trj] |
| Avira | malicious | TR/LINUX.Miner.RZ |
| Cynet | malicious | Malicious (score: 99) |
| ESET-NOD32 | malicious | Linux/CoinMiner.ATG trojan |
| F-Secure | malicious | Trojan.TR/LINUX.Miner.RZ |
| Fortinet | malicious | Adware/Miner |
| huorong | malicious | Trojan/Linux.CoinMiner.bk |
| Kaspersky | malicious | HEUR:Trojan.Linux.Miner.gen |
| Kingsoft | malicious | Linux.Troj.coinminer.v |
| Microsoft | malicious | Trojan:Linux/CoinMiner!rfn |
| Rising | malicious | Trojan.CoinMiner/Linux!8.132F9 (TFE:19:kfcMJ0bOhuE) |
| Symantec | malicious | Trojan.Miner!ATN |
| Tencent | malicious | Trojan.Linux.MinerXMRig.lri |
| TrendMicro-HouseCall | malicious | Coinminer.Linux.Gen.TL0101G526ZN |
Details From VirusTotal
Basic Properties
| MD5 | b1d4007735b147ba13f8a7087a82c884 |
| SHA-1 | 9ec2f79e9fcdb349eb0451638e50a590111d9ab5 |
| SHA-256 | 350a99830b80b5600d3a2757fa996155579ef9d0c53de95f0299f64d280b9bb1 |
| VHash | 2f70d57be0342c63bd004551e4e70a9b |
| SSDEEP | 49152:TuAjj5EtJuzmEjvFe5mz9npzQ/BUGtlqdLfYlJPh/VwAsOVccJqZmIU6iTdVKpmK:TuAjeT6ImvzQZeLfXoq+RMpMB/fARB4 |
| TLSH | T159E55B2EB9A224BDC9B6C8308B6FD1367E3174984222797F3584D5702F57E241F29BE1 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=bee0931b1323e737f3607b1b79c692c8f110cc0a, stripped |
| File size | 3.1 MB |
History
| First seen on VirusTotal | 2026-06-29 19:02 UTC |
| Last submission | 2026-07-03 17:07 UTC |
| Last analysis | 2026-10-08 17:47 UTC |
| Last modified on VirusTotal | 2026-10-08 19:49 UTC |
Known Names
4rmow7y.exe48219d3bf38e9bc92781030d2c8cfebd48b2a9769e031261a4db4e3a9499244flibgcrypt
hash_sha256
f706aba0d150db2d8f385cbbbb6a6d4fe590a5d184f29e5b1b05fcc4c2cd0932
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/f706aba0d150db2d8f385cbbbb6a6d4fe590a5d184f29e5b1b05fcc4c2cd0932
IOC database
- Type
- hash_sha256
- Value
f706aba0d150db2d8f385cbbbb6a6d4fe590a5d184f29e5b1b05fcc4c2cd0932- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/files/f706aba0d150db2d8f385cbbbb6a6d4fe590a5d184f29e5b1b05fcc4c2cd0932
cve
CVE-2018-21028
IOC database
- Type
- cve
- Value
CVE-2018-21028- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
https://gotenberg.dev/docs/getting-started/installation
VT 0 / 93
UrlVoid 0 / 36
IOC database
- Type
- url
- Value
https://gotenberg.dev/docs/getting-started/installation- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
Basic Properties
| TLD | dev |
| Final URL | https://gotenberg.dev/docs/getting-started/installation |
| Page title | Installation | Gotenberg |
| Last HTTP status | 200 |
History
| First seen on VirusTotal | 2025-04-15 07:49 UTC |
| Last submission | 2026-10-09 01:05 UTC |
| Last analysis | 2026-10-09 01:05 UTC |
| Last modified on VirusTotal | 2026-10-09 01:07 UTC |
domain
gotenberg.dev
VT: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/gotenberg.dev
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
gotenberg.dev- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 401 Client Error: Unauthorized for url: https://www.virustotal.com/api/v3/domains/gotenberg.dev
References (2)
-
OTX pulse
AlienVaulkt OTX
Since April 2026, PoeLLM malware has been actively targeting exposed AI/LLM and open-source services including LiteLLM, Ollama, Gotenberg, and Gitea, with possible Ivanti Sentry targeting. The campaign employs an unusual command-and-control mechanism where infected systems derive C2 server addresses from keywords embedded in a poem hosted on GitHub. This financially-motivated operation deploys XMRig and Iron cryptocurrency miners, connecting victims to Kryptex mining infrastructure. Compromised
- reference AlienVaulkt OTX
Remediations (10)
-
web:aigovernance.com
Lumen Black Lotus Labs published research on a campaign it named Canto Incognito , documenting how malware called PoeLLM has infected more than 3,000 enterprise servers since April 2026. The targets were servers running open-source AI inference tools, specifically LiteLLM and Ollama, which organizations use to run AI models on their own hardware rather than through cloud providers. Attackers ...
-
web:aviatrix.ai
In 2026, cybersecurity researchers identified the Canto Incognito campaign, deploying PoeLLM malware to build a cryptocurrency mining botnet targeting AI and LLM infrastructure. Active since April 2026, the campaign infected over 3,400 servers, peaking at nearly 2,200 affected systems in mid-June. The Italian-speaking threat actors used a creative technique, hiding command-and-control ...
-
web:cybersecuritynews.com
Hackers use a GitHub-hosted poem to direct PoeLLM malware to C2 servers, powering a cryptocurrency-mining botnet.
-
web:dev.to
1. Basic Information Article Title: Canto incognito : tracking the PoeLLM malware Publisher: Lumen Black Lotus Labs Publication Date: 2026-10-07 Original Article: Lumen Black Lotus Labs Related Sources: BleepingComputer, LiteLLM GHSA-v4p8-mg3p-g94g Related Malware : PoeLLM , XMRig, Iron miner Related Threat Groups: None specified Related CVEs: CVE-2026-42271, CVE-2026-10520 Related Products ...
-
web:shattered.io
A cryptomining botnet hiding its control-server address inside a poem posted to GitHub has infected more than 3,000 servers since April 2026, according to research from Lumen Technologies' Black Lotus Labs team published October 7, 2026. The malware , dubbed PoeLLM , and the broader operation behind it, which researchers named Canto Incognito , targets internet-exposed AI and developer ...
-
web:tech.yahoo.com
More than 3,400 servers running AI and developer tools have been compromised by a financially motivated botnet that retrieves its command-and-control address from a poem stored on GitHub. Lumen Technologies' Black Lotus Labs, which named the broader operation Canto Incognito , reported the campaign active since at least April 2026 and still recruiting new victims as of October 2026.
-
web:techjacksolutions.com
Technical Analysis Canto Incognito is a financially motivated campaign tracked by Lumen Black Lotus Labs since April 2026, deploying the PoeLLM malware family against internet-exposed AI and LLM infrastructure. Initial access exploits known vulnerabilities across multiple services.
-
web:undercodenews.com
A Poem Is Hiding a Malware Control System A seemingly harmless poem published on GitHub has become the unlikely backbone of a sophisticated malware campaign that has compromised more than 3,400 servers since April, according to Lumen Technologies' Black Lotus Labs. Researchers have dubbed the malware PoeLLM , and its most unusual feature is the way it discovers its command-and-control (C2 ...
-
web:www.lumen.com
PoeLLM targets exposed AI infrastructure Black Lotus Labs is tracking the use of the " PoeLLM " malware , which is currently deployed in a cryptocurrency-mining and exploit-scanning campaign targeting enterprise AI infrastructure and other applications, including development toolkits.
-
web:www.theregister.com
How adversarial poetry works Black Lotus Labs attributed the PoeLLM malware to an Italian-speaking criminal, and named the financially motivated campaign Canto Incognito because it hides the malicious commands in a poem posted to a GitHub repository.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Reputation of linked indicators
DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.
| Indicator | Type | Verdict | Score |
|---|---|---|---|
edge-ru-07.kryptex.network |
domain | high | 59 |