Author: DigitalSpying Cyber Threat Research Team | Date: October 11, 2026 | Category: AI Infrastructure Security, Botne
t Analysis, Command and Control Architecture, Cryptomining Malware
________________
Executive Summary
Between October 7 and October 11, 2026, cybersecurity researchers at Lumen Technologies Black Lotus Labs Research uncovered a sophisticated campaign orchestrated by a novel malware framework designated as PoeLLM. This stealthy operation has successfully recruited more than 3,400 internet-exposed artificial intelligence and developer infrastructure nodes into a global, high-performance computing botnet. As reported by CyberScoop: PoeLLM malware has assembled a sweeping botnet, the threat actor has actively maintained this infrastructure since at least April 2026, capitalizing on the rapid enterprise deployment of open-source AI utilities.
PoeLLM systematically targets unauthenticated and unpatched open-source AI proxy servers, inference engines, and developer tools—with a primary focus on LiteLLM, Ollama, Gotenberg, and self-hosted Gitea instances.
The defining technical signature of the PoeLLM framework lies in its novel Command and Control (C2) resolution strategy. Rather than embedding static IPv4/IPv6 addresses, abusing traditional Dynamic DNS (DDNS) providers, or relying on algorithmic Domain Generation Algorithms (DGAs), PoeLLM fetches a seemingly innocuous piece of literary prose published in a public GitHub repository. By programmatically scraping verse line structures, word counts, and stanza delimiters, the payload dynamically computes and decodes the operational C2 IP addresses. This steganographic "dead-drop" mechanism completely bypasses standard signature-based network defenses and automated threat intelligence feeds.
Further details documented by Help Net Security: Cryptomining botnet hides C2 addresses in GitHub poem, infects AI servers highlight how the campaign bridges pure resource theft (monetized via XMRig cryptomining) with the latent potential for massive corporate data exfiltration across modern corporate LLM stacks.
________________
Attack Flow & The GitHub "Poem" Steganography C2
Infection Lifecycle
The operational sequence of PoeLLM relies on automated internet-scale scanning for typical default management ports associated with modern AI developer stacks. The diagram below illustrates the path from initial scanning to internal lateral movement:+-------------------+ Probes Exposed Ports +-----------------------+
| PoeLLM Scanner | -----------------------------> | Targeted AI Endpoint |
| (External Mesh) | | LiteLLM (4000) |
+-------------------+ | Ollama (11434) |
| Gotenberg (3000) |
+-----------------------+
|
| Exploits Unauth API
| / Path Traversal
v
+-------------------+ Retrieves Raw Text +-----------------------+
| GitHub Repository | <----------------------------- | Lightweight Loader |
| (Poem Dead-Drop) | | (Shell/Bash Script) |
+-------------------+ +-----------------------+
| |
| Delivers Steganographic Prose |
+------------------------------------------------------+
|
v
+-------------------+ Computes IPv4 Address +-----------------------+
| Active C2 Node | <----------------------------- | Stego Parser Module |
| (Obfuscated IP) | | (Line/Word Extraction)|
+-------------------+ +-----------------------+
| |
| Downloads Optimized Payload |
v v
+----------------------------------------------------------------------------+
| Final Execution: XMRig Cryptominer + Internal Subnet Discovery & Propagation |
+----------------------------------------------------------------------------+
Deep-Dive: Abusing Reputational Trust via Dead-Drop Resolvers
The reliance on trusted third-party web platforms as Dead-Drop Resolvers (DDRs) represents an evolving evasion technique. Corporate security operations centers (SOCs) and egress firewalls generally allow uninterrupted outbound traffic over HTTPS to raw.githubusercontent.com, gitlab.com, and pastebin.com. Threat actors leverage this implicit trust:
1. Reputational Bypasses: Content Delivery Networks (CDNs) servicing GitHub carry pristine domain reputation scores. Automated Secure Web Gateways (SWGs) rarely block or inspect raw text downloads from public repositories unless specific threat feeds flag exact commit URLs.
2. Dynamic Resilience: If an active C2 IP address is taken offline by hosting providers or law enforcement, the threat actors do not need to update the malware binary installed across thousands of victim hosts. They simply push a new Git commit updating the poem's stanza parameters. The botnet seamlessly re-resolves the new infrastructure during its next check-in cycle.
Stanza Conversion Algorithm
The parser contained within the initial loader script extracts the active IPv4 address using a lightweight mathematical transformer. The benign-looking poem follows a strict structured syntax disguised as free-verse poetry.
Example Prose Structure (Hosted on GitHub)
Silent fans spin through the dark, [Line 1]
Cooling circuits, glowing bright, [Line 2]
Three thousand nodes await the spark, [Line 3]
Deep inside the synthetic night. [Line 4]
Data flows like endless streams, [Line 5]
Prompts awaken dormant thought, [Line 6]
Shadows weave digital dreams, [Line 7]
Wisdom found, never bought. [Line 8]
Extraction Mechanism
The extraction script parses the stanza lines and applies a positioning offset to calculate each IPv4 octet:
* Octet 1: Derived from the character length of Line 1 subtracted by a predefined seed constant ($L_1 - K_1$).
* Octet 2: Calculated by multiplying the word count of Line 3 by the total number of punctuation marks in Stanza 1.
* Octet 3: Extracted by converting the ASCII value of the 4th character in Line 6 into its hexadecimal equivalent.
* Octet 4: Determined by taking the base64-decoded byte value of the last word in the final line.
Because the underlying text mimics standard natural language structures, static regular expression (RegEx) checks designed to catch standard IPv4 patterns or Base64 strings fail to trigger alerts.
________________
The Vulnerability Landscape in Emerging AI Stacks
As organizations rush to integrate artificial intelligence, security guardrails are frequently bypassed in favor of deployment speed. The targeted tooling reflects a widespread deployment of shadow AI infrastructure:
Targeted Component
Default Port
Primary Exploitation Vector
Impact of Compromise
LiteLLM
4000
Unauthenticated management endpoints, exposed master keys, and vulnerable proxy routes.
Full intercept of corporate prompts, credential theft for downstream commercial LLMs (OpenAI, Anthropic), C2 propagation.
Ollama
11434
Unauthenticated REST API access (/api/pull, /api/generate), path traversal vulnerabilities.
Malicious model execution, remote code execution (RCE) via companion wrappers, host resource exhaustion.
Gotenberg
3000
Unrestricted API endpoints converting HTML/Office docs to PDF; chromium SSRF vector.
Server-Side Request Forgery (SSRF), local file read, compute hijacking.
Gitea
3000 / 2222
Outdated webhooks, unpatched remote execution CVEs, weak admin credentials.
Source code repository compromise, lateral movement to internal build pipelines.
Deconstructing the Tooling Vulnerabilities
LiteLLM Proxy Layer
LiteLLM serves as an open-source router designed to unify access across dozens of underlying LLM providers under a single OpenAI-compatible API interface. In many enterprise environments, LiteLLM is deployed without enforcing master key checks (LITELLM_MASTER_KEY). PoeLLM probes for exposed LiteLLM instances and uses administrative endpoints to inject malicious configuration payloads or map upstream corporate API keys.
Ollama Inference Engine
Ollama allows developers to run large language models locally. By default, prior to hardened configurations, binding Ollama to 0.0.0.0 exposes port 11434 to the internet without native authentication mechanisms. PoeLLM utilizes the API to trigger model pulls, overload system memory, and leverage secondary file-writing capabilities to drop persistent shell scripts onto host operating systems.
________________
The Dual Threat: Compute Hijacking & Model Poisoning
The arrival of PoeLLM marks a shift in how threat actors exploit AI infrastructure, posing both immediate operational impacts and long-term security risks. As documented by Shattered Threat Analysis: PoeLLM Malware Hits 3,400+ AI Servers, the malware impacts both system resources and data integrity. +-----------------------------------+
| Compromised AI Gateway Node |
+-----------------------------------+
|
+-----------------------+-----------------------+
| |
v v
+-----------------------+ +-----------------------+
| Immediate Payload: | | Latent Threat Vector:|
| Compute Hijacking | | Data & Integrity |
+-----------------------+ +-----------------------+
| • XMRig Cryptomining | | • Prompt Sniffing |
| • GPU/CPU Saturation | | • API Key Exfiltration |
| • Hardware Thermal | | • Response Injection |
| Degradation | | • Model Poisoning |
+-----------------------+ +-----------------------+
1. Immediate Impact: High-Performance Compute Hijacking
AI servers are built around high-density multi-core CPUs and enterprise GPU clusters (NVIDIA A100/H100/H200 series). PoeLLM deploys customized, highly optimized XMRig binary variants designed to dynamically detect available CUDA and CPU thread capabilities. The malware throttles its mining rate when administrative interactive terminal sessions are detected, maintaining persistent background cryptomining while degrading underlying hardware performance.
2. Latent Enterprise Risk: Gateway Sniffing and Poisoning
While cryptomining provides immediate monetization for the threat actors, controlling an AI proxy gateway like LiteLLM introduces severe security risks to enterprise networks:
* Prompt Interception: Attacking nodes can log raw prompt data sent by internal software engineers, leaking trade secrets, proprietary source code, and personally identifiable information (PII).
* API Credential Harvesting: Upstream bearer tokens for enterprise accounts (e.g., OpenAI, Anthropic, Azure OpenAI) stored in environment variables can be exfiltrated back to the C2 network.
* Malicious Response Injection: Threat actors can modify model responses in real time, injecting malicious code snippets, altered financial data, or subtle misdirections into production pipelines.
________________
Enterprise Defense Blueprint & Hardening AI Deployments
To counter campaigns like PoeLLM, security and DevOps teams must harden exposed AI components and enforce zero-trust networking principles.
1. Mandatory API Authentication
Never expose AI management interfaces or inference endpoints to the public internet without strong authentication layers.
* Enforce strict bearer token verification across all LiteLLM deployment environments by explicitly setting LITELLM_MASTER_KEY.
* Implement mutual TLS (mTLS) or place an authenticating reverse proxy (e.g., NGINX, Traefik, OAuth2-Proxy) in front of unauthenticated interfaces like Ollama and Gotenberg.
2. Zero Internet Exposure for Inference Nodes
Restrict service bindings to isolated local interfaces or secure internal container networks:# Force Ollama to bind strictly to localhost
export OLLAMA_HOST="127.0.0.1:11434"
Configure Docker container network bindings explicitly
docker run -d -p 127.0.0.1:11434:11434 --name ollama ollama/ollama
Inference servers and proxy layers should reside strictly within private Virtual Private Clouds (VPCs), accessible only via secure VPNs or zero-trust network access (ZTNA) connectors.
3. Egress Network Filtering & Monitoring
* Restrict Outbound Connections: Configure outbound firewall rules to block traffic directed toward known cryptomining pool ports (e.g., 3333, 4444, 5555, 8080) and Stratum protocols.
* Monitor GitHub Raw Traffic: Log and inspect HTTP/HTTPS GET requests targeting raw.githubusercontent.com. Flag unusual user-agents, non-browser fetch routines (such as curl or wget issued by service accounts), and unexpected text file downloads from newly created public repositories.
4. Container Sandboxing & Immutable Runtime Environments
Prevent malware loaders from executing persistent shell scripts or dropping binaries into temporary directories:# Kubernetes SecurityContext configuration snippet
securityContext:
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 10001
allowPrivilegeEscalation: false
* Mount /tmp and /dev/shm with noexec flags to stop binary execution from temporary space.
* Utilize runtime security tools (e.g., Falco) to detect unexpected process spawns (such as bash or sh) originated by AI application user contexts.
________________
Strategic Verdict
The discovery of the PoeLLM botnet illustrates a broader trend in threat actor operations: the militarization of shadow AI infrastructure. As enterprises rapidly adopt open-source AI utilities, developer convenience often outpaces security governance. PoeLLM demonstrates how threat actors can combine creative steganographic techniques with simple API exploitation to build resilient botnets.
Organizational security teams must extend standard vulnerability management and zero-trust policies to encompass every node in their AI ecosystem—from raw inference tools to API orchestration proxies. Unmonitored and unauthenticated AI deployments represent high-value targets for operational disruption, enterprise data loss, and unauthorized compute utilization.