PoeLLM malware hides C2 address via GitHub poem, has compromised more than 3,400 servers
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
Lumen Technologies' Black Lotus Labs reports that a malware named PoeLLM has compromised more than 3,400 servers since April, primarily targeting open-source AI services, and uses a poem published on GitHub to hide the command-and-control (C2) server address. The poem appears harmless; the malware extracts four specific words from the poem based on fixed text anchors, then maps each word to a set of IP addresses via a built-in dictionary, and the four numbers combine to form the current C2 address. Threat actors can change the C2 location simply by rewriting the poem, without updating the malware itself; the relevant keywords have been changed at least a dozen times. Researchers first discovered the PoeLLM infrastructure in June this year while investigating a maximum-severity vulnerability in Ivanti Sentry, and subsequently uncovered a large-scale vulnerability scanning and cryptocurrency mining botnet involving compromised services and tools such as LiteLLM, Ollama, Gotenberg, and Gitea.