Overview
- Researchers at Lumen’s Black Lotus Labs say the PoeLLM campaign has compromised more than 3,400 internet-facing servers since April 2026 and reached a peak of roughly 800 active infections in a single day.
- The malware derives its command-and-control address by extracting four words from a poem in a GitHub file, mapping each word to a number with a hard-coded dictionary, and combining those numbers into an IPv4 address that the operator has updated about 11 times.
- Attackers have focused on exposed AI and open-source services such as LiteLLM, Ollama, Gotenberg, Gitea and Ivanti Sentry by scanning default ports like 3000 and 4000 and chaining known flaws including CVE-2026-42271 to gain access.
- Once inside, PoeLLM installs XMRig and Iron miners that connect victims to the Kryptex pool, converts some compromised machines into scanners and exploit servers, and includes a remote shell and early-stage SSH brute-force behavior that could enable broader abuse.
- Defenders have blocked known C2s and are advised to patch affected software, restrict public access to AI infrastructure, review outbound logs for the published IoCs, and prepare for second-order risks such as token theft, LLM misuse, and lateral movement on networks.