PoeLLM malware leverages poetic obfuscation for resilient C2 infrastructure
Lumen Technologies’ Black Lotus Labs disclosed in a Wednesday report that the PoeLLM malware has compromised more than 3,400 servers since April by exploiting a novel technique: using a poem hosted on GitHub as a dynamic lookup table for command-and-control (C2) server addresses. The malware extracts four specific words from the poem based on their position relative to fixed text anchors, then maps each word to a numeric value via a hard-coded dictionary embedded in the malware. These four numbers combine to form the current C2 server IP address, allowing the threat actor to rotate infrastructure simply by updating the poem — without altering the malware code.
How the poem-based C2 mechanism evades detection
According to Ryan English, information security engineer at Black Lotus Labs, this approach renders the C2 infrastructure invisible to traditional network monitoring tools. "The IP address used for C2 communications is invisible outside of the victim’s netflow," English explained. "In other malware samples, there might be a hard-coded fallback C2 address, or URL which points to an IP address written elsewhere on the internet. To anyone who comes across it, this is simply a poem on GitHub. It has no links, no files to download, no encrypted text that could easily be flagged as malicious, even by advanced models."
He emphasized that without access to the malware itself, security researchers would have no reason to suspect the poem is malicious or to deduce the hidden IP address: "There would be no reason for any security researcher to identify this poem as malicious — or know about the IP address hidden within it — unless they had access to the malware referencing it."
PoeLLM botnet targets AI services and expands via proxy chaining
Researchers first encountered PoeLLM infrastructure in June during an investigation into a maximum-severity vulnerability in Ivanti’s Sentry secure mobile gateway product. This led to the discovery of a large-scale exploit-scanning and cryptocurrency-mining botnet that had compromised numerous open-source AI and developer tools, including LiteLLM, Ollama, Gotenberg, and Gitea.
While PoeLLM has proven highly effective at compromising AI-related services at scale, the full scope of the threat actor’s post-compromise activities remains under investigation. English noted that the malware includes functionality for remote code execution, which could enable abuse of AI models on victim servers and facilitate downstream attacks through public-facing services.
"Through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more," English said. The botnet’s resilience is further enhanced by converting compromised servers into attack proxies, allowing the actor to pivot quickly if one C2 node is detected and reported.
Poem updates enable seamless infrastructure rotation
The poem serves as a dynamic C2 lookup table. When the malware retrieves the updated version from GitHub, it extracts four keywords based on their positional relationship to fixed anchors in the verse. Each word is matched to a pre-defined value in the malware’s hard-coded dictionary — for example, in one observed version, "driver" mapped to 92, "diode" to 119, "decryption" to 165, and "string" to 74 — which together form the C2 IP address.
This mechanism allows the threat actor to change the entire poem and thus the C2 location without updating the malware. As a result, many of the C2 servers used in the campaign have evaded detection by crowd-sourced security tools. "Many of the C2s used in this campaign were never detected on crowd-sourced security tools, indicating that this layer of obfuscation was very helpful in improving the resilience of a C2," English stated.
Attribution points to Italian-speaking threat actor
Black Lotus Labs assessed that the threat actor behind PoeLLM is likely Italian or fluent in Italian, based on multiple Italian-language comments observed in the malware code. Researchers also noted that the actor has used Italy-based servers for testing and C2 infrastructure. However, the size of the operation remains unknown, and no links to other threat groups or campaigns have been identified to date.
Source: CyberScoop