PoeLLM: cryptomining botnet hides its C2 in a GitHub poem

On 7 October 2026 Black Lotus Labs, the research team at Lumen Technologies, published its analysis of PoeLLM, malware that breaks into internet-facing AI services and open-source tools, uses them to mine cryptocurrency and turns them into new attackers. The campaign, named Canto Incognito, has one unusual feature: the address of the command-and-control (C2) server is not written in the malware but derived from a poem published on GitHub.

What happened

According to the researchers, the campaign has been active since April 2026: the first commit containing the poem dates from 13 April. CyberScoop and Help Net Security report more than 3,400 compromised servers, The Register more than 3,000, mostly in the United States and Western Europe. At its peak, according to The Register, over 800 infected servers were active per day, and the campaign is still claiming new victims.

Most affected servers were running vulnerable versions of LiteLLM and Ollama; several hundred ran Gotenberg (PDF conversion) and Gitea (software development). The researchers found PoeLLM while investigating an Ivanti Sentry vulnerability, CVE-2026-10520: in early June 2026 a compromised Ivanti Sentry contacted the server 5.78.73[.]122 and shortly afterwards began scanning for other vulnerable devices. The sources do not name affected companies.

Technical details

Initial access. From May the attackers scanned the internet mainly on ports 3000 and 4000, the defaults for Gotenberg and LiteLLM. When a vulnerable server turns up, an exploit server sends it a crafted POST request that makes it download a file from the C2. In the analysed sample, the targeted LiteLLM endpoint is /mcp-rest/test/connection, tied to CVE-2026-42271, a LiteLLM command injection vulnerability.

The poem as an address book. The poem, titled “On the Nature of Connection”, sits in the dash.css file of a fork of the nodejs.org website source, published by GitHub user ejejejdfbbebe; the malware has no connection to Node.js. PoeLLM fetches the poem and extracts four words from fixed positions, located by text fragments that act as anchors (for example “In the silent hum of” and “of distant servers”, according to The Register). A dictionary hard-coded in the malware converts each word into a number: the four numbers form the IPv4 address of the C2. In one version of the poem, the words “driver”, “diode”, “decryption” and “string” produced 92.119.165.74.

To move the C2, the operator only has to change the words on GitHub: the bots work out the new address themselves, with no malware update. The Register and Help Net Security count 11 edits since the first commit, while CyberScoop says at least a dozen; the decoding method has never changed. According to the researchers, many of the C2 servers used never appeared in crowd-sourced security tools.

What it does on the server. PoeLLM runs the XMRig and Iron miners and connects victims to Kryptex mining infrastructure. It has a remote shell, HTTP/S scanning and exploit delivery: every compromised server becomes a scanner and exploit server, which is how the botnet grows. Recently, groups of bots started targeting SSH and other login portals: the researchers see this as a sign of experiments with distributed brute-force attacks, still at an early stage.

Attribution. Black Lotus Labs attributes the campaign to an Italian-speaking, financially motivated actor: comments in the code and on the GitHub pages are in Italian, and the servers used for testing and C2 are located in Italy; no links to other groups have emerged.

MITRE ATT&CK (mapping from the reported facts): T1190 (Exploit Public-Facing Application), T1105 (Ingress Tool Transfer), T1102.001 (Web Service: Dead Drop Resolver), T1496 (Resource Hijacking), T1595.002 (Vulnerability Scanning), T1110 (Brute Force).

Impact on European and Italian companies

Western Europe is among the most affected regions. The targets are services many companies rushed into production: gateways to language models, self-hosted models, document converters, code repositories. Mining is the visible damage, but the researchers warn that the same access enables credential theft, abuse of model tokens, data loss and lateral movement.

For NIS2 entities (in Italy, Legislative Decree 138/2024), self-hosted AI services are fully part of vulnerability and asset management; a compromise with a remote shell must also be assessed for notification to the national CSIRT.

What to do now

1. Inventory the LiteLLM, Ollama, Gotenberg, Gitea and Ivanti Sentry instances reachable from the internet.
2. Remove direct exposure for anything that does not need to be public: access through a VPN or an authenticated reverse proxy, ports 3000 and 4000 closed to the outside.
3. Update LiteLLM to the version that fixes CVE-2026-42271 and Ivanti Sentry for CVE-2026-10520, following the vendors’ advisories.
4. Look for signs of compromise: XMRig or other miner processes, unusual CPU and GPU usage, connections to mining pools, POST requests to /mcp-rest/test/connection in LiteLLM logs.
5. Check outbound traffic: scans towards ports 3000, 4000 and 22 originating from your servers, and requests to GitHub from machines with no reason to make them. Restrict egress from AI servers to the destinations they need.
6. Check your logs against 5.78.73.122, 92.119.165.74 and the full list of C2 servers, with first-seen and last-seen dates, published by Black Lotus Labs.
7. If you find a compromised server, isolate it, rebuild it from a clean image and rotate the API keys and tokens configured on the service.

How ARXDOME helps

ARX Expose shows open ports, recognised products and known vulnerabilities on public services from the outside: that is where an LLM gateway exposed by mistake shows up. ARX Shield lists open vulnerabilities by machine and package, highlighting those already exploited, and lets you isolate a suspicious server from the network. ARX Sentry, with the Linux agent, collects processes, ports and installed software, and brings firewall logs, including blocked outbound traffic, into the SOC pages.

Last updated: 8 October 2026