Canto incognito: tracking the PoeLLM malware

Summary

Black Lotus Labs reports that PoeLLM has operated since at least April 2026, compromising exposed AI/LLM services and other internet-facing applications for cryptocurrency mining and further exploitation. Reported victims include LiteLLM, Ollama, Gotenberg and Gitea deployments, predominantly in the United States and Western Europe. Ivanti Sentry is a possible additional target, but its exploitation path is not established in the supplied evidence.^[0]

The campaign's distinctive feature is a poem-based C2 locator. Malware extracts four words or phrases from a poem stored in a GitHub repository, maps them to numbers using an embedded dictionary, and assembles the current C2 IPv4 address. Changing selected poem keywords redirects infected hosts without changing the decoding pattern. The report describes 11 such changes following the April 13 initial commit.^[0]

PoeLLM combines remote-shell access, Iron and XMRig miners, HTTP/S scanning, and exploit deployment. Compromised servers become additional scanning and exploitation workers, while observed Kryptex connections support the assessment of financial motivation. Later traffic toward SSH and other login portals suggests distributed brute-force experimentation, not a confirmed mature capability. Italian-language artifacts and infrastructure relationships support the researchers' assessment of an Italian-speaking operator, but no threat actor is named.^[0]

Campaign-specific findings rely on Black Lotus Labs' report rather than independent corroboration in the supplied material. Its opening cites more than 3,400 affected servers and over 800 active servers per day, while the body repeatedly cites almost 2,200 affected servers and almost 800 active per day; the measurement differences are not explicitly reconciled. At publication on October 7, 2026, the report identified three active C2 addresses and stated that Black Lotus Labs had blocked traffic to and from PoeLLM C2 infrastructure.^[0]

Attack chain

1. 1. Discover exposed services: The operator conducted internet-wide scanning for vulnerable services, with particular emphasis on ports 3000 and 4000, associated in the report with Gotenberg and LiteLLM respectively.^[0]
2. 2. Trigger exploitation and payload retrieval: After identifying a vulnerable target, an exploitation server sent a crafted POST request instructing the target to retrieve malware from C2 port 81. One reviewed sample targeted LiteLLM's /mcp-rest/test/connection endpoint, assessed as a likely exploitation path associated with CVE-2026-42271.^[0]
3. 3. Resolve the current C2: The malware parsed the GitHub-hosted poem, extracted four designated words or phrases, translated them through a hard-coded dictionary, and constructed a C2 IPv4 address. Keyword changes allowed the operator to redirect infected hosts to replacement infrastructure.^[0]
4. 4. Establish post-infection communications: After download, the malware beaconed to C2 on one of the reported ports: 3778, 5001, 5002 or 9999. The analyzed payload also contained remote-shell functionality.^[0]
5. 5. Monetize compromised compute: The malware included Iron and XMRig miners, and infected systems were observed contacting Kryptex mining endpoints. These capabilities and connections underpin the report's financial-motivation assessment.^[0]
6. 6. Reuse victims to expand operations: Previously compromised servers were conscripted as scanning and exploitation workers, producing outbound activity toward additional targets on ports 3000 and 4000 and directing vulnerable hosts back to C2 for malware retrieval. Later SSH and login-portal targeting suggested experimentation with distributed brute force; its maturity remained uncertain.^[0]

Disclosure timeline

How it works

The reported entry mechanism is exploitation of publicly exposed services rather than a single universal vulnerability. The operator scanned for vulnerable targets and issued crafted POST requests that instructed targets to download malware from C2 port 81. Device banners and open-port enrichment associated victims with several products, but those associations do not establish the precise exploit used against every product.^[0]

For LiteLLM, a reviewed sample targeted /mcp-rest/test/connection. Black Lotus Labs identifies this endpoint as a likely exploitation path and links it to command injection tracked as CVE-2026-42271. The supplied article does not expose the complete request in text or provide an affected-version range, so the mechanism should not be generalized to every LiteLLM deployment.^[0]

PoeLLM's C2 locator reads a poem titled On the Nature of Connection from dash.css in a GitHub repository controlled by user ejejejdfbbebe. The repository is a fork of the Node.js website source, but the researchers found no apparent connection between the malware and Node.js code or its website.^[0]

The parser extracts three fields case-insensitively: text between 'In the silent hum of ' and a comma; text between 'each pulse of ' and ' threading'; and text between 'Beyond the wall of ' and a comma. For the fourth field, it locates 'of distant servers', walks backward to the preceding word, and requires that word to follow 'the '. An embedded dictionary converts the four extracted values into IPv4 octets.^[0]

In the report's worked example, driver maps to 92, diode to 119, decryption to 165, and string to 74, producing 92.119.165.74. The operator can rotate C2 by changing these keywords while leaving the parsing pattern intact. This is a resilient C2-discovery mechanism; the supplied evidence does not establish an operating-system persistence mechanism.^[0]

Several C2 addresses exposed vulnerable router administration pages served by Boa. The first router was reported vulnerable to CVE-2018-21027 and CVE-2018-21028, but researchers explicitly lacked direct evidence of exploitation. Repeated use of similarly exposed routers supports an assessment of infrastructure repurposing, not confirmation of the exact router-compromise method.^[0]

The Ivanti Sentry connection is also bounded: the researchers discovered the campaign during an investigation of CVE-2026-10520 and observed a compromised Sentry host contacting C2 and then scanning. The article does not establish that this CVE was the host's initial-access mechanism.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• PoeLLM turns exposed application servers into both revenue-producing miners and infrastructure for compromising additional systems; the incident is not limited to unauthorized compute consumption.^[0]
• The durable hunting opportunity is the C2-locator mechanism as well as its resolved addresses: a stable GitHub poem parser allowed the operator to rotate infrastructure through small keyword changes.^[0]
• Product presence, confirmed exploitation paths, and operator attribution have different confidence levels. The LiteLLM endpoint is a likely exploit path; Ivanti Sentry targeting and router-compromise methods remain less certain; an Italian-speaking operator is an assessment, not a named-actor attribution.^[0]
• Treat campaign scale as reported but imprecise. The article's differing victim totals and daily-activity figures should not be collapsed into one definitive measurement.^[0]
• The supplied SentinelOne excerpt reinforces the broader resource-hijacking risk of exposed AI infrastructure, but it does not independently validate PoeLLM's infrastructure, attribution or victim counts.^[0][6]

Defensive actions

• Audit external exposure of LiteLLM, Ollama, Gotenberg and Gitea deployments, and restrict service access with firewalls or equivalent access controls. Prioritize exposed ports 3000 and 4000 where they correspond to the targeted services.: The campaign scanned internet-facing services, especially those ports, and used exposed applications as entry points. The article specifically highlights Gotenberg's warning against direct internet exposure.^[0]
• Include AI/LLM services and supporting open-source tools in vulnerability inventory and patch cycles. Validate applicable vendor fixes for the LiteLLM command-injection issue identified in the report rather than assuming a fixed version from this dossier.: PoeLLM exploited exposed, vulnerable services, and the report identifies CVE-2026-42271 as relevant to a likely LiteLLM exploitation path. Exact fixed releases are not supplied.^[0]
• Search current and historical network logs for the listed C2 addresses, then apply blocks to confirmed malicious C2 infrastructure. Review port-81 downloads and subsequent communications on ports 3778, 5001, 5002 and 9999.: The report ties port 81 to payload delivery and the other ports to post-download beaconing. Black Lotus Labs reports using C2 traffic blocking as its disruption measure.^[0]
• Investigate outbound scanning from application servers, especially concentrated traffic to ports 3000 and 4000. Review unusual distributed SSH or login-portal targeting without treating it as proof of a mature brute-force module.: Compromised hosts were reused as exploitation workers. The researchers also observed later login-service targeting but explicitly assessed that capability as potentially early-stage.^[0]
• Hunt for the supplied malware hash and correlate suspicious libgcrypt files or miner execution with the listed Kryptex destinations and other PoeLLM evidence.: The analyzed ELF contained remote-shell, mining, scanning and exploitation capabilities. Kryptex destinations are mining-service infrastructure, so related traffic is more useful when correlated with the malware or campaign C2 activity.^[0]
• Track changes to the identified GitHub poem artifact during investigation and use the documented extraction pattern to identify replacement C2 addresses. Avoid treating the repository's Node.js fork relationship as evidence that Node.js itself is compromised.: The operator rotated C2 by changing four poem fields while retaining the decoding pattern. The researchers explicitly found no apparent malware connection to Node.js code or its website.^[0]
• Review internet-exposed router administration interfaces and apply timely security updates. Include routers, firewalls and IoT devices in the device-maintenance practices recommended by the report.: Multiple PoeLLM C2 hosts exposed vulnerable router administration pages, suggesting reuse of compromised edge infrastructure. The precise exploitation method was not established for the initial router.^[0]