Cryptomining malware used poetry to infect 3400 servers
The Cryptic Code of the Cyberattack: How Poetry Led to Mass AI Server Hijacking
A sophisticated new campaign targeting the burgeoning world of artificial intelligence infrastructure has been uncovered, revealing a bizarre yet highly effective method of cybercrime. Cybersecurity researchers have tracked a malicious cryptomining campaign, dubbed Canto Incognito, which has managed to infect over 3,400 “victim servers.” The operation highlights a growing vulnerability in how exposed AI services and hardware are being targeted for illicit financial gain.
The operation, monitored by Lumen’s cybersecurity research team, exposed a chilling truth: attackers are exploiting publicly accessible systems to repurpose powerful hardware—specifically GPUs—for unauthorized cryptocurrency mining. The primary motivation appears to be financial, capitalizing on the fact that AI infrastructure, due to its exposure, is becoming an increasingly attractive target for exploiters.
But what made this campaign particularly clever was the command-and-control mechanism. Instead of relying on typical code or direct communication, the threat actors employed a highly obfuscated system, using a poetic approach to hide their tracks. The malware directed infected hosts to new command-and-control servers by encoding addresses within four words of a two-stanza poem posted on GitHub. This poetic method was altered eleven times to constantly shift the routing to new servers, acting as a perfect vehicle for hiding critical malicious instructions.
The infected servers were quickly repurposed into sophisticated scanning and exploit servers, running mining software like XMRig and Iron, connected to Kryptex mining infrastructure. The core strategy was simple: exploit public vulnerabilities to gain access, map the network, and initiate the mining operation.
The primary targets were infrastructure related to open-source AI and development tools. The malware specifically focused on services like LiteLLM, which acts as an AI Gateway, and Ollama, which allows users to run open-weight models locally. Other systems hit included Gotenberg, a Docker-based PDF conversion API, and Gitea, a self-hosted Git platform. This indicates that developers and users of these widely available tools are in immediate danger.
The exploitation path often involved leveraging flaws in publicly exposed services. For example, one reported exploitation path involved a flaw where two endpoints would execute commands on a host without proper role checks, demonstrating a serious vulnerability. The researchers found that exploiting these flaws in publicly exposed services allowed the malware to deploy easily across the network, with broad scanning beginning in May.
While the method of delivery was poetic obfuscation, it was not a form of malicious AI prompt injection or adversarial poetry used to trick AI models. Instead, the poetry served purely as a highly effective way to hide the destination of the connection. The creators of the malware were clever in their use of language to create an “untraceable” route for their malicious traffic.
Despite the efforts to block communications, the campaign continued to infect new victims, signaling an expanding threat landscape. As AI infrastructure continues to grow, the attack surface for enterprise systems is rapidly expanding, underscoring the urgent need for heightened security awareness. Experts urge system owners to audit external exposure, patch all network devices, and ensure that all open-source tools are properly secured to protect against these evolving and clever cyber threats.
Credit
