Poellm - GoKawiil

Cryptomining malware PoeLLM hits over 3,400 servers via poem-based C2, Black Lotus Labs finds

Lumen's Black Lotus Labs reports that a campaign called Canto Incognito has infected more than 3,400 servers since April 2026 using malware dubbed PoeLLM, which deploys XMRig and Iron cryptominers linked to Kryptex mining infrastructure. The malware hides its command-and-control addresses inside words of a two-stanza poem posted on GitHub, edited 11 times to redirect infected machines to new servers, and primarily targets exposed AI/LLM tools like LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry.

tomshardware.com · 2026-10-11

PoeLLM malware uses GitHub poem to control cryptomining botnet on 3,400 AI servers

Black Lotus Labs reports that a malware strain called PoeLLM has compromised more than 3,400 exposed AI servers, with up to 800 infected systems active on a single day. The malware, an ELF file named libgcrypt, derives its command-and-control IP address by extracting keywords from a poem hosted in a GitHub repository, updating the poem 11 times since April to rotate C2 addresses.

bleepingcomputer.com · 2026-10-07