Black Lotus Labs discloses the PoeLLM malware campaign; more than 3,400 servers compromised

Black Lotus Labs has been tracking a malware campaign named PoeLLM since April 2026, which targets AI and open-source services exposed to the internet to deploy cryptocurrency miners and scan for new targets. The malware primarily affects vulnerable external deployments such as LiteLLM, Ollama, Gotenberg, and Gitea, and may also involve Ivanti Sentry. Its command-and-control mechanism is unusual: it extracts four keywords from a poem titled "On the Nature of Connection" in a GitHub repository, converts them into numbers via a hardcoded dictionary, and assembles the current C2 IPv4 address. The poem has been modified 11 times since its initial commit on April 13, each time pointing to a new C2. The campaign has affected more than 3,400 victim servers, with over 800 active servers per day at its peak; researchers say the peak in mid-June involved nearly 2,200 affected servers.