October 8, 2026
- PoeLLM hides its C2 address in a poem on GitHub. Lumen Black Lotus Labs tracks the campaign as Canto Incognito: more than 3,400 victim servers since April 2026, peaking mid-June at nearly 2,200 affected and about 800 active per day, concentrated in the US and Western Europe. Targets are internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry deployments; the malware derives its C2 from four keywords in a poem the operator has edited repeatedly since 13 April, and compromised hosts are repurposed as scanners and exploit servers while mining via XMRig, Iron and Kryptex (Lumen, The Hacker News). · Threat Activity
in Two Hours From Public Detail to Exploit Attempts Against Atlassian