PoeLLM Malware Targets Exposed AI Servers for Cryptomining

A cryptomining campaign targeting internet-exposed services uses PoeLLM malware to compromise servers, scan for other systems and launch exploits, according to researchers at Lumen’s Black Lotus Labs (BLL).

BLL says the botnet has compromised more than 2,100 servers, with up to 800 infected systems active on a single day. It has been active since at least April, and researchers have identified at least 11 command-and-control (C2) servers. The operation targeted systems in the United States and Western Europe. Victims included services such as LiteLLM, Ollama, Gotenberg and Gitea; researchers also found signs of targeting involving Ivanti Sentry.

The malware, an ELF file named libgcrypt, gets four words or phrases from a poem in a dash.css file hosted on GitHub. It maps them to numbers with a built-in dictionary to generate a C2 IPv4 address. Changing the poem changes the address. Researchers say the operator has changed it 11 times and suspect there may have been another update.

PoeLLM includes remote-shell functions, XMRig and Iron cryptocurrency miners, web scanning and exploit deployment. BLL says infected servers scan ports 3000 and 4000 and attempt to exploit CVE-2026-42271, which affects LiteLLM’s MCP server test endpoints. Horizon.ai researchers found that it could be chained with CVE-2026-48710 to achieve unauthenticated remote code execution. BLL could not confidently identify the operator, but assesses with moderate confidence that they are Italian.