PoeLLM: A Poem on GitHub Is the Command Channel for a Botnet Eating Exposed AI Servers

A poem on GitHub is now the command channel for a botnet eating AI servers

Lumen’s Black Lotus Labs published its research on PoeLLM on October 7, and the numbers are worth stating slowly: a cryptomining botnet has compromised more than 3,400 servers, most of them running exposed AI infrastructure, with 800 infected systems active on a single day at the peak. I keep coming back to the wrong part of the story. Not the Monero, not the scale. It is the way the malware finds its orders. The C2 address is not hard-coded and it is not fetched from a server. It is derived from four words in a poem.

The poetry trick

The malware is an ELF binary masquerading as libgcrypt. On startup it reads a poem titled “On the Nature of Connection” from a dash.css file inside a GitHub repository that appears to be a Node.js fork. It pulls four words or phrases out of the verse, maps them to numbers through a hard-coded dictionary, and assembles an IPv4 address. That address is its command-and-control server.

For a defender this is genuinely annoying. There is no domain to sinkhole and no C2 IP baked into the binary for an antivirus signature to catch. The poem lives on GitHub, a service nobody is going to block. When the operator wants a new C2 server, they do not recompile or re-infect anything. They edit the poem. Black Lotus Labs counted eleven edits, which means eleven C2 addresses generated from verse, and they expect at least one more.

Why AI servers specifically

The victims cluster in the United States and Western Europe, and they share a profile. They run AI and LLM tooling that got placed on the public internet without much thought: LiteLLM gateways, Ollama instances, the Gotenberg PDF converter, Gitea. Black Lotus Labs also found signs of Ivanti Sentry targeting. The firm’s reasoning is blunt: these deployments are often poorly configured, exposed by design, and sit on GPU clusters that mine cryptocurrency beautifully.

That last line is the one I want every CIO in Johannesburg or Lagos to sit with. Nobody built these servers for mining. They were built for inference, bought with capital budgets, cooled with power budgets, and then pointed at the open internet because a vendor’s setup guide said to expose port 4000. PoeLLM turns your AI pilot into someone else’s revenue stream. Worse, the compromised machine becomes a springboard. It scans for the next Gotenberg or LiteLLM victim on ports 3000 and 4000 and tries to exploit CVE-2026-42271, a flaw in LiteLLM’s MCP server test endpoints that Horizon.ai researchers showed chains with CVE-2026-48710 into unauthenticated remote code execution. A single unpatched gateway can walk your whole AI stack.

Attribution, or the lack of it

Black Lotus Labs cannot pin this to a nation state. Based on comments left in the malware and one administrative interface hosted on an Italian server, the team assesses with moderate confidence that a single Italian individual runs the operation. The infrastructure is held together with scrap: several of the C2 servers turned out to be vulnerable routers with exposed admin panels, meaning the operator is running command nodes through other people’s compromised edge devices. For payouts, victims were observed communicating with Kryptex, a Russian crypto-mining-as-a-service pool.

So the threat model for exposed AI infrastructure includes one person with a GitHub account, a poetry habit, and a mining pool login. We spend so much of our budget bracing for sophisticated groups. This campaign says the boring, opportunistic floor of the internet has found your GPU cluster.

What to actually do

• Inventory the exposure first. Ask what LiteLLM, Ollama, Gotenberg, Gitea, or any other LLM gateway your teams stood up in the last eighteen months is reachable from. If the answer is “the internet,” you are in the target set.
• Patch LiteLLM. CVE-2026-42271 chained with CVE-2026-48710 gives unauthenticated RCE. This is not a wait-for-the-next-window fix.
• Pull these services off the public interface and put them behind VPN or true zero trust access, restricted to trusted IPs. That is Black Lotus Labs’ own guidance, and it is the right call.
• Hunt for the shape of it: an ELF binary calling itself libgcrypt, traffic to Kryptex, scanning on ports 3000 and 4000, and the IoCs published with the BLL report. Also check GPU utilisation nobody can explain. That is often the only tell.

The eHawu view

PoeLLM is a network-layer problem wearing an AI costume. The root cause is not the malware’s poetry. It is that powerful, internet-reachable machines appeared inside enterprises faster than the controls around them did. That is the gap eHawu’s network layer is built for: assets get an identity, sessions get verified before anything reaches a port, and a service that has no business facing the public internet simply cannot. African enterprises are standing up AI infrastructure on compressed timelines right now, and the exposure surface has to be part of the deployment decision, not a clean-up task later. An inference cluster mining someone else’s Monero at 3am is not an incident you can defer to the next maintenance window.