PoeLLM Malware Uses Poem to Dynamically Generate Command-and-Control Addresses
Researchers at Lumen's Black Lotus Labs have identified a cryptomining campaign leveraging a novel malware strain called PoeLLM that targets exposed artificial intelligence servers. The malware, distributed as an ELF file named libgcrypt, retrieves four specific words or phrases from a poem titled “On the Nature of Connection” hosted in a ‘dash.css’ file within a GitHub repository. These extracted terms are mapped to numerical values using a hard-coded dictionary within the malware, which then generates an IPv4 address used to contact its command-and-control (C2) infrastructure.
This method allows attackers to change the C2 server location simply by updating the poem in the GitHub repository. To date, the poem has been modified 11 times, indicating active rotation of C2 infrastructure, with researchers suspecting additional updates may occur. The use of poetry as a C2 mechanism is uncommon and helps evade static detection methods that rely on fixed IP addresses or domains.
Over 3,400 AI Servers Compromised in Ongoing Botnet Campaign
According to Black Lotus Labs, the PoeLLM botnet has compromised more than 3,400 servers since its emergence in April 2026. Peak activity has seen up to 800 infected systems active in a single day. The campaign primarily targets systems in the United States and Western Europe, with victims running exposed AI and development tools such as LiteLLM, Ollama, Gotenberg (a PDF converter), and Gitea. Signs of targeting Ivanti Sentry systems were also observed during analysis.
The attackers focus on these services because they are frequently misconfigured, left publicly accessible without adequate authentication, and often run on powerful GPU-optimized hardware ideal for cryptocurrency mining. Once compromised, servers are not only used for mining but also repurposed as scanning platforms and exploit launchpads to propagate the malware further.
PoeLLM Integrates Mining Tools and Exploits Known Vulnerabilities
The PoeLLM malware payload includes multiple malicious components: it drops XMRig and Iron cryptocurrency miners to monetize compromised systems, incorporates remote-shell functionality for persistent access, and performs HTTP/S scanning on ports 3000 and 4000 — commonly associated with Gotenberg and LiteLLM services.
During post-exploitation, the malware attempts to exploit CVE-2026-42271, a vulnerability affecting LiteLLM’s MCP server test endpoints. Although initially disclosed as requiring authentication and rated high-severity, researchers from Horizon.ai confirmed that this flaw can be chained with CVE-2026-48710 to achieve unauthenticated remote code execution (RCE), significantly increasing its danger in exposed environments.
Infected Systems Communicate with Russian Crypto-Mining Service
Black Lotus Labs found that compromised PoeLLM-infected servers establish connections to Kryptex, a Russian-based cryptocurrency mining service, to monetize stolen computational resources. This connection serves as a key indicator of compromise (IoC) for defenders seeking to identify infected systems within their networks.
Further analysis of the C2 infrastructure revealed that several command-and-control servers were hosted on vulnerable router administration interfaces, suggesting the attackers may have repurposed previously compromised routers as part of their operational infrastructure. While no definitive attribution has been made, researchers assess with moderate confidence that the operator is likely Italian, based on language artifacts found in the malware code and the geographic location of a server hosting administrative panels.
Defensive Recommendations for Administrators
To mitigate the risk of PoeLLM infection, system administrators are advised to apply the latest security updates for all exposed services, particularly AI and development tools like LiteLLM and Ollama. Public internet exposure for critical assets should be minimized, and access should be restricted to trusted IP addresses only where possible.
Organizations should also monitor network traffic for connections to known IoCs shared by Black Lotus Labs, including C2 IP addresses derived from the poem-based mechanism and communication endpoints linked to Kryptex. Reviewing logs for scanning activity on ports 3000 and 4000 can help detect early signs of compromise or lateral movement attempts.
An update issued at 11:40 EST corrected the initial report of 2,100 compromised servers, reflecting the updated count of 3,400 from the live Black Lotus Labs analysis. This adjustment underscores the importance of relying on verified, real-time threat intelligence when assessing the scale of active campaigns.
Source: BleepingComputer