Security2 hOctober 17, 2026, 05:25

PoeLLM malware reads its C2 address from a poem

Black Lotus Labs found PoeLLM, a cryptominer whose ELF binary disguised as libgcrypt pulls four words from a poem in a dash.css file inside a fake Node.js fork and maps them to an IPv4 C2 address. More than 3,400 hosts have been compromised since April, with up to 800 active in a single day and at least 11 C2 servers; victims are in the US and Western Europe.

DEV Community

Open source

PoeLLM malware reads its C2 address from a poem

Moving the C2 means rewriting the poem; 11 revisions so far
Targets include internet-exposed LiteLLM, Ollama, Gotenberg, Gitea and Ivanti Sentry
The campaign chains CVE-2026-42271 and CVE-2026-48710 in LiteLLM
Infected hosts mine via Kryptex and scan ports 3000 and 4000

#LiteLLM#Ollama#Gitea#GitHub

PoeLLM cryptomining malware hits over 3,400 servers via exposed AI services

Security

Attackers use GitHub poem to infect thousands of servers with malware

Security

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

Security

PoeLLM malware reads its C2 address from a poem

PoeLLM cryptomining malware hits over 3,400 servers via exposed AI services

Attackers use GitHub poem to infect thousands of servers with malware

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

PoeLLM malware infects 2,100 AI servers in cryptomining attacks