PoeLLM Malware Targets Exposed AI Services with Poem-Based Command-and-Control

Mar 16, 2026 · Original article ↗

Summary

Black Lotus Labs details PoeLLM, a campaign exploiting exposed AI and other services to mine cryptocurrency and scan for more victims. Its malware derives changing command-and-control addresses from a poem on GitHub.

Key points

The campaign targets exposed services including LiteLLM, Ollama, Gotenberg, and Gitea; Ivanti Sentry may also have been targeted.
PoeLLM parses selected words in a GitHub-hosted poem and converts them into a C2 IP address, allowing the operator to change infrastructure by editing the poem.
The malware includes remote shell functions, XMRig and Iron cryptocurrency miners, scanning capabilities, and exploit deployment.
Compromised servers were reused to scan for and exploit additional vulnerable systems; researchers also observed activity against SSH and other login portals, but said the distributed brute-force capability’s maturity was uncertain.
Black Lotus Labs reports nearly 2,200 affected servers and almost 800 active per day at peak; the article also describes victims as predominantly in the United States and Western Europe.
The researchers blocked traffic to and from identified PoeLLM C2 servers and recommend auditing external exposure, restricting service access, and patching internet-facing systems.

Article Details

Attack Vectors: Exploitation of publicly exposed vulnerable services, particularly LiteLLM and Gotenberg; the malware sample referenced the LiteLLM endpoint /mcp-rest/test/connection in connection with CVE-2026-42271.
Compromised systems were used to scan for additional vulnerable services and send crafted POST requests that directed targets to download malware from C2 servers.
Infected hosts ran cryptocurrency miners and were observed scanning SSH ports and other login portals; the maturity of the reported distributed brute-force capability was uncertain.
The malware derived changing C2 addresses from selected words in a poem hosted in a GitHub repository.
Defensive Notes: Review network monitoring logs for the reported IOCs.
Audit internet exposure after installing open-source tools and restrict external access to required service ports.
Keep routers, firewalls, IoT devices, and internet-facing AI and enterprise tools updated and patched.
Secure exposed APIs behind a firewall and consider managed SASE and attack-surface monitoring.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`malwarescan[.]xyz`	Domain assessed by the researchers as possibly owned and operated by the PoeLLM creator.
HOSTNAME	`edge-ru-07[.]kryptex[.]network`	Host identified as part of the Kryptex mining infrastructure contacted by victims.
IPV4	`103[.]249[.]201[.]108`	PoeLLM C2 IP; listed as active at publication.
IPV4	`120[.]224[.]114[.]212`	PoeLLM C2 IP; malicious download paths were also observed on this C2.
IPV4	`136[.]148[.]69[.]233`	IP listed among additional C2 infrastructure observed during the campaign.
IPV4	`15[.]204[.]178[.]28`	IP listed among additional C2 infrastructure observed during the campaign.
IPV4	`178[.]128[.]14[.]204`	PoeLLM C2 IP; listed as active at publication.
IPV4	`185[.]132[.]53[.]158`	IP listed among additional C2 infrastructure observed during the campaign.
IPV4	`191[.]37[.]28[.]160`	Initial C2 IP decoded from the poem; used during initial infection testing.
IPV4	`45[.]133[.]73[.]28`	IP listed among additional C2 infrastructure observed during the campaign.
IPV4	`46[.]21[.]245[.]211`	Kryptex mining infrastructure contacted by PoeLLM victims.
IPV4	`5[.]180[.]174[.]162`	Kryptex mining infrastructure contacted by PoeLLM victims.
IPV4	`5[.]78[.]73[.]122`	PoeLLM C2 IP that infected hosts contacted; served malicious files on port 81.
IPV4	`89[.]39[.]253[.]46`	IP listed among additional C2 infrastructure observed during the campaign.
IPV4	`92[.]119[.]164[.]50`	PoeLLM C2 IP; listed as active at publication.
IPV4	`92[.]119[.]165[.]74`	Example of a previous C2 IP derived from the poem.
SHA256	`6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501`	Hash of a PoeLLM malware sample reviewed by Black Lotus Labs.