Security1 hOctober 24, 2026, 22:32

PoeLLM botnet controls 3,400 servers via a poem on GitHub

Black Lotus Labs discovered the PoeLLM botnet, which has infected about 3,400 servers running vulnerable versions of Ollama, LiteLLM and Gotenberg. Command-and-control addresses are derived from a poem hosted on GitHub: swapping four words in the text redirects infected machines to a new C2 server. The botnet is mainly used to mine and steal cryptocurrency.

BGR

Open source

PoeLLM botnet controls 3,400 servers via a poem on GitHub

About 3,400 servers infected, with a peak of nearly 2,200 in June 2026
The GitHub poem was updated at least 11 times to rotate C2 addresses
Three of the 12 discovered C2 IPs are still active
Attack vector: vulnerable Ollama, LiteLLM and PDF converter Gotenberg

#Ollama#LiteLLM#GitHub

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

Security

PoeLLM malware reads its C2 address from a poem

Security

Attackers use GitHub poem to infect thousands of servers with malware

Security

PoeLLM botnet controls 3,400 servers via a poem on GitHub

PoeLLM botnet mines crypto on AI servers via LiteLLM flaw

PoeLLM malware reads its C2 address from a poem

Attackers use GitHub poem to infect thousands of servers with malware

PoeLLM malware infects 2,100 AI servers in cryptomining attacks