PoeLLM botnet has turned more than 2,100 exposed servers into miners and scanners
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
The Watch · Security desk
What happened
- The botnet has run since at least April, and its operator has stood up at least 11 command-and-control servers as activity grew.
- Infected servers scan ports 3000 and 4000, associated with Gotenberg and LiteLLM, and try to exploit CVE-2026-42271 in LiteLLM.
- Horizon.ai researchers confirmed CVE-2026-42271 can be chained with CVE-2026-48710 to get remote code execution without authentication.
- The malware decodes its command server's IP address from words in a poem hosted on GitHub, and the operator has edited the poem 11 times to move it.
- Black Lotus Labs made no confident attribution but assesses with moderate confidence that the operator is Italian.
Why it matters
- Who has to decide decision Patch queues that filed CVE-2026-42271 as an authenticated bug need to move it up, because an exposed LiteLLM proxy hit with the full chain requires no credentials.
- Who's exposed exposure Each hijacked server becomes the operator's launch point, so the scans and exploit attempts hitting other networks arrive from the victim's own address.
- What it limits constraint Blocking one C2 address holds only until the operator next edits the poem, because the address lives in a GitHub file the operator can change at will.
- What it costs cost The owner of a hijacked GPU host pays for the compute and power behind mining traffic sent to Kryptex.
Next story · Build · 3d ago
A GitHub poem edited 11 times keeps pointing infected servers to new command hostsConfirmed2 publishers
CVE-2026-42271 sits in LiteLLM's MCP server test endpoints [13]. It was originally disclosed as requiring authentication and scored high severity [13]. BleepingComputer's account of the research does not name the flaw used against the Ollama hosts among the victims [6].
On any one day the botnet is smaller than its running total: the busiest day, 800 active infections, is at most about 38 percent of the more than 2,100 servers compromised [2][19].
Each implant carries a remote shell, the XMRig and Iron miners, HTTP/S scanning and an exploit deployer [10]. Victims communicate with Kryptex, a Russian crypto-mining service [11]. The victim list runs past AI tooling to the Gotenberg PDF converter and the Gitea development toolkit, with signs of Ivanti Sentry targeting as well [6]. The operation targeted systems across the United States and Western Europe [5].
The researchers give a plain reason for the AI focus. LLM deployments are often poorly configured and exposed online, and they typically run on GPU clusters suited to cryptomining [16].
The command lookup is the uncommon part [7]. The implant, an ELF file named libgcrypt, reads four words or phrases from a poem titled "On the Nature of Connection" inside a dash.css file, in a GitHub repository that appears to fork Node.js [8]. A hard-coded dictionary maps the words to numbers that form the C2's IPv4 address [9]. Several C2 servers had vulnerable router administration interfaces. Lumen's researchers take that as a sign the operator reused compromised routers [18].
The Italian assessment rests on comments in the malware and an Italy-based server hosting the administrative interface [14]. The indicators of compromise are public, and Black Lotus Labs advises checking network monitoring logs for connections to them [15].
Its other advice is to apply the latest updates, reduce public internet exposure and restrict external access to trusted IPs [15]. As described, the spread step needs LiteLLM and Gotenberg ports reachable from outside [12]. Restricting those ports to trusted addresses closes that path without waiting on a patch [12][15].
What to watch
- Another edit to the "On the Nature of Connection" poem, which Black Lotus Labs suspects is coming, would move the C2 again and confirm the operator is still maintaining the botnet.
- Whether PoeLLM's exploit module adds CVE-2026-48710, the second half of Horizon.ai's chain, to its LiteLLM attempts.
- New exploits in the kit aimed at Ollama or Gitea, the other tools common among victims.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption50
- Hype gap+5
- Incentives
- Not scored
- Confidence70
Perspective Coverage
6 publishers- Builder
- Builder 34%
- Operator
- Operator 59%
- Investor
- Investor 7%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
A cryptomining campaign targeting exposed AI services is using PoeLLM malware to turn compromised servers into scanners and exploit launchpads.
- [2]
PoeLLM's peak activity reached as many as 800 infected systems active on a single day.
- [3]
To change the C2 address the operator changes the poem; it has been modified 11 times so far, and researchers suspect there may be at least another update.
- [4]
PoeLLM has been active since at least April, its activity has increased significantly since then, and at least 11 C2 servers have been spun up to date.
- [5]
The operation targeted systems across the United States and Western Europe.
- [6]
Many victims run exposed AI tools such as LiteLLM and Ollama, the Gotenberg PDF converter and the Gitea development toolkit; signs of Ivanti Sentry targeting were also found.
- [7]
The malware uses an uncommon method to retrieve command-and-control addresses by extracting keywords from a poem hosted on GitHub.
- [8]
PoeLLM, an ELF file named libgcrypt, retrieves four words or phrases from a poem titled "On the Nature of Connection" in a dash.css file hosted in a GitHub repository that appears to fork Node.js.
- [9]
The malware maps the poem's words to numbers using a hard-coded dictionary, generating an IPv4 address corresponding to the C2.
- [10]
The malware incorporates remote-shell functionality, XMRig and Iron cryptocurrency miners, HTTP/S scanning, and exploit deployment capabilities.
- [11]
Victims communicate with a Russian crypto-mining service called Kryptex.
- [12]
A compromised server becomes a springboard to spread the malware, scanning ports 3000 and 4000, associated with Gotenberg and LiteLLM, and attempting to exploit CVE-2026-42271.
- [13]
CVE-2026-42271 impacts LiteLLM's MCP server test endpoints; it was originally disclosed as requiring authentication and received a high-severity score.
- [14]
Black Lotus Labs could not make a confident attribution but assesses with moderate confidence that the operator is Italian, based on comments in the malware and an Italy-based server hosting the administrative interface.
- [15]
Administrators should apply the latest security updates, reduce public internet exposure, restrict external access to trusted IPs, and inspect network monitoring logs for connections to the indicators of compromise shared by Black Lotus Labs.
- [16]
Black Lotus Labs says AI/LLM implementations are attractive targets because they are often poorly configured, exposed online, and typically run on powerful GPU clusters suitable for cryptomining.
- [17]
Horizon.ai researchers confirmed CVE-2026-42271 could be chained with CVE-2026-48710 for unauthenticated remote code execution.
- [18]
Several PoeLLM C2 servers featured vulnerable router administration interfaces, suggesting the attacker reused compromised routers.
- [19]
PoeLLM's busiest day (800 active infections) equals at most about 38 percent of the more than 2,100 servers it has compromised.
- [20]
Researchers at Lumen's Black Lotus Labs say PoeLLM has compromised more than 2,100 servers.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comPoeLLM malware infects exposed AI servers in cryptomining attacks
2 articles · October 7, 2026
- cyberscoop.comPoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
2 articles · October 7, 2026
- dev.toPoeLLM: Compromising Public AI Servers for Cryptomining and Further Reconnaissance
2 articles · October 8, 2026
- helpnetsecurity.comCryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
1 article · October 8, 2026
- runtimewire.comPoeLLM turns exposed AI and developer servers into miners and attack launchpads
1 article · October 7, 2026
- thehackernews.comPoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
2 articles · October 8, 2026