A cryptomining campaign has compromised more than 3,400 servers, exploiting exposed AI services and other internet-facing tools. PoeLLM malware uses infected machines to mine cryptocurrency, scan for additional targets and launch further attacks.
Researchers at Lumen’s Black Lotus Labs have tracked the operation since at least April. At its busiest, the network had as many as 800 infected systems active in a single day.
Meanwhile, the operators use an unusual technique to direct the malware: a poem on GitHub conceals the information needed to locate command-and-control servers.
Exposed AI Services Offer Valuable Computing Power
The campaign has targeted systems across the United States and Western Europe. Victims include servers running LiteLLM, Ollama, the Gotenberg PDF converter and the Gitea development platform.
Researchers also uncovered signs of attempts to target Ivanti Sentry.
According to Black Lotus Labs, AI deployments can combine weak configuration with direct internet exposure. In addition, their powerful GPU infrastructure makes them attractive targets for cryptocurrency mining.
After compromising a server, the attackers use its resources for more than mining. The infected machine also helps identify and attack other exposed services, expanding the operation’s reach.
A GitHub Poem Hides Control Server Addresses
PoeLLM malware arrives as a Linux ELF executable named libgcrypt. It retrieves a file called dash.css from a GitHub repository that appears to be a Node.js fork.
However, that file contains a poem titled “On the Nature of Connection.” The malware extracts four words or phrases and converts them into numbers using a built-in dictionary.
Those numbers form an IPv4 address pointing to a command-and-control server.
Consequently, the operator can redirect infected machines by editing the poem. Researchers observed 11 changes and suspect another update may also exist.
The operation has used at least 11 command-and-control servers as its activity has grown.
Infected Servers Scan for New Targets
The malware combines remote-shell access with HTTP and HTTPS scanning, exploit deployment and cryptocurrency mining capabilities. It includes XMRig and Iron miners.
Researchers also observed infected systems communicating with Kryptex, a Russian cryptocurrency mining service. That finding alone does not establish the operator’s location.
To spread further, compromised servers scan ports 3000 and 4000, associated with Gotenberg and LiteLLM. They also attempt to exploit CVE-2026-42271 in LiteLLM’s MCP server test endpoints.
Initially, researchers described that vulnerability as requiring authentication and assigned it a high-severity rating. However, subsequent research showed that attackers could combine it with CVE-2026-48710 to execute code remotely without authentication.
This attack path increases the risk for exposed installations that lack the relevant security fixes.
Infrastructure Suggests Use of Compromised Routers
Black Lotus Labs found vulnerable router administration interfaces on several command-and-control servers. This suggests the attackers may have repurposed compromised routers to support the campaign.
Nevertheless, the researchers could not confidently attribute the operation to a specific actor.
They assessed with moderate confidence that the operator may be Italian. Their assessment relied on comments within the malware and an Italy-based server hosting its administration interface.
Those clues remain an assessment rather than confirmed attribution.
Administrators Urged to Patch and Limit Exposure
To reduce the risk of infection, administrators should install current security updates and limit public access to critical services.
Where external access is necessary, restricting connections to trusted IP addresses can reduce exposure. Administrators should also review network logs for connections matching the indicators published by Black Lotus Labs.
These checks matter because an infected server can support both cryptomining and attacks against additional systems.
0 responses to “PoeLLM Malware Hijacks AI Servers for Cryptomining and Further Attacks”