A malware strain called PoeLLM has compromised more than 3,400 servers running internet-exposed AI and developer tools since April, according to Lumen Technologies’ Black Lotus Labs, CyberScoop reported Wednesday. The malware locates its command-and-control servers by reading a poem posted on GitHub, which lets its operator move infrastructure without pushing any update to infected machines.

What Happened

PoeLLM targets open-source services that are often deployed on public servers, including the Ollama model runner, the LiteLLM gateway, the Gotenberg PDF converter and the Gitea code-hosting tool. Black Lotus Labs said it first came across the operation while investigating a vulnerability in Ivanti Sentry, and Ivanti Sentry systems were also compromised.

BleepingComputer reported that infections peaked at about 800 systems on a single day. It said the attackers exploit CVE-2026-42271, a high-severity flaw in test endpoints of LiteLLM’s MCP server, and CVE-2026-48710, which can be chained with it to run code without authentication. The scanning concentrates on ports 3000 and 4000, the defaults for Gotenberg and LiteLLM.

RelatedBank of America Added 1,000 Contractors to Fix Flaws Found by Anthropic's Mythos

Once inside, the malware has mostly been used to mine cryptocurrency with the XMRig and Iron miners, which connect to the Russian mining service Kryptex. Infected machines are also turned into scanners and exploit servers that hunt for further vulnerable targets. Victims are concentrated in the U.S. and Western Europe.

How the Poem Works

The command server address is hidden in a poem titled “On the Nature of Connection,” stored as a file named dash.css in a GitHub repository. The malware finds four words at fixed positions in the text and looks each one up in a dictionary built into its code, which maps words to numbers. Together the four numbers form an IPv4 address.

When the operator sets up a new server, they change a few words in the poem and every infected machine calculates the new address on its own. BleepingComputer counted 11 command servers used so far. Ryan English, a security engineer at Black Lotus Labs, told CyberScoop that the file looks like nothing more than a poem, with no links, downloads or encrypted text that might be flagged.

Why It Matters

Self-hosted model servers and LLM gateways are frequently stood up quickly by development teams, sometimes with weak or no authentication and directly reachable from the internet. That makes them attractive targets: they often run on expensive GPU hardware, and gateways such as LiteLLM can hold API keys for commercial model providers.

Cryptomining is the visible payload today, but Black Lotus Labs said PoeLLM also gives its operator remote code execution, which could be used to abuse the AI models on victim servers and to reach downstream services. The Hacker News, citing the researchers, reported that recent network data shows the operator experimenting with distributed brute-force attacks against SSH and login portals.

Black Lotus Labs assessed with moderate confidence that the operator is Italian or Italian-speaking, based on Italian-language comments in the code and testing and command servers hosted in Italy.

What to Watch

Black Lotus Labs recommends applying patches, keeping services such as Ollama, LiteLLM, Gotenberg and Gitea off the public internet, restricting access to trusted IP addresses and checking network logs for the indicators it published. Security teams will be watching whether the operator shifts from mining to abusing the models and stored credentials on compromised servers, and whether GitHub takes down the repository hosting the poem.