A GitHub poem edited 11 times keeps pointing infected servers to new command hosts
Lumen's Black Lotus Labs found a cryptominer on more than 3,400 servers, mostly running vulnerable AI services. Each poem edit moves the hosts to a new control server, so patching and closing public ports are the controls a server owner holds.
The Engineer · Build desk
Key figures: over 3,400 victim servers hit by the PoeLLM cryptominer; 3 C2 servers active when Lumen published, out of 12 C2 servers; and the first 900 victims, per Lumen.
| Figure | Value | Note | Claim |
|---|---|---|---|
| Victim servers hit by PoeLLM, over | 3,400 servers | 1 | |
| C2 servers active when Lumen published | 3 servers | out of 12 C2 servers | 9 |
| First victims, per Lumen | 900 victims | 7 |
What happened
- The malware pulls specific words from the poem and converts them into an IPv4 address, and each new version of the poem points to a new C2 server.
- The payload is XMRig and Iron miners wired to Kryptex mining infrastructure, and each infected server also becomes a scanner and exploit server for the next round.
- For LiteLLM, a crafted POST to the connection endpoint was likely the path, through CVE-2026-42271, a missing role check that CISA listed as exploited in June.
- Gotenberg and Gitea are also among the victims, and Ivanti Sentry may have been targeted; one Sentry instance is how Lumen found the campaign.
Why it matters
- What doesn't add up contradiction Lumen's report gives an exploitation path only for LiteLLM, and even that one is rated likely, so the published record cannot split the 3,400 between LiteLLM and Ollama flaws.
- Who's exposed exposure Ollama is not internet-exposed by default and Gotenberg has a guide warning against exposing it, so an infected instance of either was most likely opened up by its operator.
- Who has to decide decision Teams get two fixed versions to aim at: LiteLLM 1.83.7 or later and Ivanti Sentry R10.5.2, R10.6.2 or R10.7.1. Everything else is checked by searching connection logs for the indicators on Lumen's GitHub page.
- What it sets up precedent Lumen says enterprise attack surfaces are "expanding rapidly as AI infrastructure grows", and Tom's Hardware judges more attacks like this one likely.
Next story · Security · Oct 7
PoeLLM botnet has turned more than 2,100 exposed servers into miners and scannersConfirmed5 publishers
The poem is only a pointer. Tom's Hardware notes that it is not a jailbreak, a prompt injection or the "adversarial poetry" described in a paper last year [18]. Its title, "On the Nature of Connection", is at least on topic [11]. The researchers told The Register that a poem is "a perfect vehicle for hiding an important message" [12].
The design gives the operator one cheap lever. Committing a new version redirects the infected hosts to a new C2 server [3]. The decoding side has stayed put. Lumen said at the time of reporting that "the malware creator has not changed the pattern used in deciphering the poem" [5]. Count the first commit as a version and 11 edits make 12 versions, the same as the 12 C2 servers in Lumen's count [20]. If each version maps to one server, the commit history is a log of the operator's addresses.
Lumen blocked all traffic to and from the PoeLLM C2 servers [10]. The dev.to summary says the block limits the operator's ability to send new commands to infected systems [14]. It does not clean a host. The miner stays until its owner removes it. When Lumen published, nine of the 12 servers were not active, a share of 75 percent [19], yet the campaign "continues to infect new victims" [13].
The sequence on LiteLLM is short. Black Lotus Labs has tracked the campaign since April [1]. Tom's Hardware says an April LiteLLM fix probably patched the exploitation path [8]. Broad scanning began in May [15]. If the fix covers that path, a host updated in April was patched before the scanning started [21]. In our view, the LiteLLM victims are a patch-cadence problem.
The first 900 victims shared one thing: contact with "an endpoint for the Russian crypto mining service," according to Lumen, and Tom's Hardware says that points to a possible financial motive [7]. Tom's Hardware also quotes the report on why AI hosts draw attention: "AI infrastructure is becoming an attractive target" because exposed AI services may contain valuable data and hardware access, especially GPUs [22].
What to watch
- Whether the poem's decoding pattern changes. Lumen said it was unchanged at reporting, so a change would break any detection built on it.
- Whether the poem gets a thirteenth version or a new repository once the remaining active C2 servers are blocked.
- Whether Lumen publishes the exploitation methods for Ollama, Gotenberg and Gitea, which the report summary does not detail.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Lumen's Black Lotus Labs reports that over 3,400 victim servers were hit by cryptomining malware PoeLLM during a campaign named Canto Incognito, tracked since April 2026.
- [2]
The malware's C2 mechanism encodes addresses in four words of a two-stanza poem on GitHub, altered 11 times so far, to direct affected hosts to new C2 servers.
- [3]
The poem was first committed in April, and each new version points to a new C2 server.
- [4]
The malware decodes the new address by pulling specific words from the poem and converting them into an IPv4 address.
- [5]
Lumen says that "the malware creator has not changed the pattern used in deciphering the poem" at the time of reporting.
- [6]
The malware's payload consists of XMRig and Iron miners connected to Kryptex mining infrastructure, and infected servers become scanners and exploit servers.
- [7]
The "primary commonality amongst the first 900 victims" was contact with "an endpoint for the Russian crypto mining service," Lumen says; Tom's Hardware says this indicates the campaign may be financially motivated.
- [8]
Most of the hosts hit look to be running vulnerable versions of open-source AI/LLM services such as LiteLLM and Ollama, despite an April LiteLLM fix that probably patched the exploitation path.
- [9]
When Lumen published its report, three of the 12 C2 servers were still active.
- [10]
Lumen says it has "blocked all traffic to and from the PoeLLM C2 servers."
- [11]
The poem is titled "On the Nature of Connection".
- [12]
The researchers told The Register that a poem is "a perfect vehicle for hiding an important message."
- [13]
The campaign "continues to infect new victims" as of Lumen's report.
- [14]
Lumen has blocked communication to the control locations used by the perpetrators, limiting the ability to send new commands to the infected systems.
- [15]
The malware is "deployed through vulnerability exploitation of publicly exposed services," with broad scanning beginning in May.
- [16]
For LiteLLM, a crafted POST to the connection endpoint was likely the exploitation path, based on a flaw where two endpoints would run a supplied command on the host with no role check (CVE-2026-42271), which CISA added to its list of exploited vulnerabilities in June.
- [17]
Fixed versions are LiteLLM 1.83.7 or later and Ivanti Sentry R10.5.2, R10.6.2 or R10.7.1; to check systems, look at connection logs for the indicators of compromise listed on Lumen's GitHub page.
- [18]
The poem is used only to point infected servers to the C2 server; it is not an AI jailbreak through harmful requests, prompt injection, or the "adversarial poetry" described in a paper last year.
- [19]
Nine of the 12 C2 servers were not active when Lumen published, which is 75 percent.
- [20]
Counting the first commit as a version, 11 edits give 12 poem versions, equal to the 12 C2 servers Lumen counted.
- [21]
If the April LiteLLM fix covers the exploitation path, a host updated in April was patched before the May scanning began.
- [22]
"AI infrastructure is becoming an attractive target" because exposed AI services may contain valuable data and hardware access, especially GPUs.
- [23]
Lumen says enterprise attack surfaces are "expanding rapidly as AI infrastructure grows," and Tom's Hardware says more attacks like this seem likely.
- [24]
Lumen did not detail the exploitation methods for Ollama, Gotenberg and Gitea.
- [25]
Ollama is not internet-exposed by default, and Gotenberg has a guide warning not to expose it to the internet.
- [26]
Gotenberg and Gitea are among the affected products, and Ivanti Sentry may also have been targeted; one Sentry instance was how Lumen discovered the campaign.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toThousands of computers infected with malware that generates digital currencies
1 article · October 12, 2026
- tomshardware.comCryptomining malware that locates its control server in a GitHub poem has hit more than 3,400 servers, researchers say
1 article · October 11, 2026
Topics and entities
Topics
- Command-and-control techniques
- AI Infrastructure Security
- Cryptojacking