PoeLLM reads its command-and-control address out of a poem. The malware, an ELF binary named libgcrypt, pulls four words or phrases from a poem titled "On the Nature of Connection" that lives in a dash.css file inside a GitHub repository posing as a fork of Node.js. A hard-coded dictionary maps each word to a number, and the four numbers assemble into an IPv4 address. To move the C2, the operator rewrites the poem. Lumen's Black Lotus Labs counts 11 revisions so far and expects at least one more.
The rest of the campaign is a cryptomining operation that happens to like AI servers. Black Lotus Labs has tracked more than 3,400 compromised hosts since at least April, with as many as 800 active on a single day at peak, served by at least 11 C2 servers. Victims sit in the United States and Western Europe. Many of them run AI tooling exposed to the internet: LiteLLM, Ollama, the Gotenberg PDF converter, and Gitea, with signs of Ivanti Sentry targeting as well.
The appeal is the hardware. LLM deployments tend to be reachable from the internet, poorly configured, and sitting on GPU clusters, which is exactly what a miner wants. Once PoeLLM lands, it drops a remote shell, the XMRig and Iron miners, HTTP/S scanning, and exploit-deployment code. Infected hosts report to Kryptex, a Russian mining service.
Each compromised server becomes a scanner and exploit launchpad for the next. It sweeps ports 3000 and 4000, the defaults for Gotenberg and LiteLLM, and tries CVE-2026-42271 against what it finds. That bug sits in LiteLLM's MCP server test endpoints. It was disclosed as a high-severity issue that required authentication, which would have kept it to authenticated callers. Horizon.ai showed it chains with CVE-2026-48710 for unauthenticated remote code execution, which is what lets a mass-scanning worm use it at all.
Black Lotus Labs found vulnerable router administration interfaces on several of the C2 servers, which suggests the operator is reusing compromised routers as infrastructure. Attribution is thin: the researchers assess with moderate confidence that the operator is Italian, based on comments left in the malware and an Italy-based server hosting the administrative interface.
For anyone running these services, the guidance follows from how the campaign spreads. The two CVEs chain into unauthenticated RCE on LiteLLM, so patch LiteLLM and the rest of the target list. The scanning hits default ports on services that should not be public, so pull Gotenberg, LiteLLM, Ollama, Gitea, and Ivanti Sentry off the open internet and restrict access to trusted source IPs. Black Lotus Labs published indicators of compromise; check network logs for connections to them.
