Actor Profile

Canto Incognito is a financially motivated threat actor attributed with moderate confidence to an Italian-speaking operator based on Italian-language artifacts and netflow indicators. The actor has been active since at least April 2026, orchestrating a cryptojacking campaign that leverages compromised AI and LLM infrastructure to deploy cryptocurrency miners (XMRig, Iron) and connect victims to Kryptex, a Russian cryptocurrency mining service. The actor demonstrates moderate technical sophistication through creative C2 obfuscation techniques and self-propagating botnet capabilities.

TTPs (Tactics, Techniques, Procedures)

The actor exploits known vulnerabilities in publicly exposed services including LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances to gain initial access. Post-compromise, the PoeLLM malware is deployed, which retrieves C2 addresses from a poem hosted on GitHub (github[.]com/ejejejdfbbebe) where specific word changes encode new C2 locations. Compromised hosts are repurposed as scanners that identify similar vulnerable targets via internet-wide scanning, then send HTTP POST requests to exposed ports instructing targets to download malware from the C2. The actor deploys XMRig and Iron cryptocurrency miners to abuse compute resources. Recent activity suggests experimentation with distributed SSH brute-force attacks, though this capability's maturity is uncertain. Key techniques align with resource hijacking, botnet expansion through lateral scanning, and C2 obfuscation via steganographic methods.

Targets & Patterns

Canto Incognito primarily targets enterprise-facing AI and LLM infrastructure deployments, specifically LiteLLM and Gotenberg services, as well as Gitea repositories and Ivanti Sentry appliances. The targeting is deliberate and financially motivated: AI/LLM infrastructure offers high-value compute resources suitable for cryptocurrency mining, potential access to sensitive data, and internet-exposed attack surfaces with exploitable vulnerabilities. Victims are concentrated in the United States and Western Europe, with over 3,400 servers infected since April 2026. At peak operations in mid-June 2026, nearly 2,200 servers were affected with approximately 800 active daily. The technology and cryptocurrency sectors are primary targets due to their deployment of powerful GPU/compute infrastructure and exposure of AI services to the internet.

Historical Context

The Canto Incognito campaign represents an emerging trend of threat actors specifically targeting AI and LLM infrastructure for cryptojacking operations. Active since April 2026 with the first GitHub repository commit on April 13, 2026, the campaign peaked in mid-June 2026 with nearly 2,200 compromised servers. The campaign demonstrates evolution in cryptojacking tactics by specifically seeking out high-compute AI workloads rather than traditional server infrastructure. Recent netflow data indicates the actor is experimenting with distributed brute-force capabilities against SSH and login portals, suggesting ongoing capability development. This campaign aligns with broader industry observations that AI infrastructure is becoming an increasingly attractive target for financially motivated actors seeking powerful compute resources.

Defensive Recommendations

  • Monitor outbound connections to known cryptocurrency mining pools (Kryptex, XMRig infrastructure) and block traffic to mining services at the network perimeter
  • Implement strict access controls and authentication for internet-facing AI/LLM services (LiteLLM, Gotenberg) and ensure all instances are patched against known vulnerabilities
  • Detect anomalous outbound scanning behavior from internal hosts, particularly HTTP POST requests to unusual external IPs on non-standard ports, which may indicate botnet scanner activity
  • Monitor GitHub repository access patterns and block connections to suspicious repositories (e.g., github[.]com/ejejejdfbbebe) that may host C2 configuration data
  • Establish baseline CPU/GPU utilization metrics for AI infrastructure and alert on sustained unexpected spikes that may indicate cryptomining activity, particularly processes associated with XMRig or Iron miners