Lumen says PoeLLM decodes its C2 address from a GitHub poem, then exploits exposed LiteLLM, Ollama, Gotenberg and Gitea servers to run XMRig and Iron miners.
Lumen's Black Lotus Labs has published "Canto Incognito", a report on PoeLLM, a botnet it says has been active since at least April 2026. According to Lumen, PoeLLM takes over internet-exposed AI and developer infrastructure, naming LiteLLM, Ollama, Gotenberg and Gitea as targets, mainly in the US and Western Europe. Lumen says the main goal is cryptomining with XMRig and Iron, and that infected servers are reused as scanners and exploit hosts. The report does not name a group. Lumen assesses, with moderate confidence, that the operator is Italian-speaking, citing an admin server in Italy.
How many victims
Lumen's report gives two totals and does not reconcile them. Its key takeaways cite "more than 3,400" victim servers; its body text cites "almost 2,200" victim servers since April. Lumen puts the botnet at around 800 servers a day at its peak. Until Lumen clarifies, treat any single total as approximate.
The poem
According to Lumen, the C2 address is not hard-coded. The bot reads a poem titled "On the Nature of Connection", stored as dash.css in a fork of the nodejs.org site under the GitHub account ejejejdfbbebe. Lumen says the malware pulls three keywords using fixed text delimiters and a fourth using a rule tied to the phrase "of distant servers". A built-in dictionary turns each keyword into a number, and the four numbers form an IPv4 address. In the example Lumen gives, from a June 23 sample, driver, diode, decryption and string mapped to 92, 119, 165 and 74, giving 92.119.165[.]74.
Lumen counts 11 edits to the poem since the first commit on April 13, 2026. Only the keywords change, so the operator can move C2 by editing a public file while the malware stays the same.
PoeLLM timeline as reported by Lumen Black Lotus Labs, from the first poem commit to the report.
Infection and payload
Lumen describes exploitation as a crafted POST request that makes the target fetch a file from the C2. The report ties the LiteLLM path to CVE-2026-42271, command injection in the /mcp-rest/test/connection endpoint (see our coverage of the CVE in Google GTIG counts 141 exploited flaws). It names LiteLLM on port 4000 and Gotenberg on port 3000, and gives no product versions.
Ivanti Sentry is how Lumen came across the campaign: it says a compromised Ivanti Sentry host (CVE-2026-10520) led it to PoeLLM. The report's summary lists Ivanti Sentry targeting only as possible.
Lumen says the payload is an ELF named libgcrypt (SHA-256 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501). It offers a remote shell, Iron and XMRig miners, HTTP/S scanning and exploit deployment. Per Lumen, downloads come from port 81 (/private/python3.6, /private/bins.sh), beacons use ports 3778, 5001, 5002 and 9999, and mining goes to Kryptex endpoints 5.180.174[.]162:8029 and 46.21.245[.]211:7029.
Infrastructure
Lumen says the first C2 was a compromised Brazilian router running a Boa web server. It lists 12 C2 addresses, 3 of the 12 active at publication, and publishes the full list in its IOC repository (github.com/blacklotuslabs/IOCs). According to Lumen, compromised routers and victim servers are reused as C2 and exploit nodes.
What we suggest
This is our general advice, not Lumen's:
- Check network logs against Lumen's published IOCs, including outbound connections to the Kryptex endpoints above.
- Keep AI gateways and developer tools such as LiteLLM, Ollama, Gotenberg and Gitea off the public internet, and review what is exposed after installing any new open-source service.
- Patch LiteLLM for CVE-2026-42271, and follow Ivanti's guidance for CVE-2026-10520 if you run Ivanti Sentry.
- Keep routers, firewalls and IoT devices updated.
- Treat unexplained CPU load on AI gateway hosts as a possible miner.