Security accounts on X spent the weekend amplifying Lumen Black Lotus Labs' October 7 research on PoeLLM, a botnet that has compromised more than 3,400 servers running self-hosted AI tooling since April. The amplification is recent; the underlying research is verified, published, and concrete.
Key facts
- Lumen's Black Lotus Labs published the research on October 7: 3,400+ servers compromised since April 2026, most in the US and Western Europe, with peak activity of almost 800 active servers per day (Lumen report).
- The malware exploits internet-exposed instances of LiteLLM, Ollama, Gitea, and Gotenberg, per Lumen's report as relayed by Help Net Security.
- The targeted LiteLLM endpoint "/mcp-rest/test/connection" matches CVE-2026-42271, a command-injection flaw already on CISA's KEV list.
- From May onward the operator scanned ports 3000 and 4000, the defaults for Gotenberg and LiteLLM.
- The C2 address hides in a GitHub poem titled "On the Nature of Connection"; eleven poem edits since April 13 each redirected victims to a new server.
- X velocity is medium: the story moved through security-amplifier accounts including @OWASPHyderabad and @tchsignal, not through major lab handles.
What's driving the conversation
The posts circulating this weekend are relays, not hot takes. @tchsignal and @OWASPHyderabad passed along the botnet's scale and its targeting of AI services, which is how security-press findings usually cross from the infosec bubble into the builder bubble. Engagement is moderate; this is not a viral pile-on. The conversation's energy comes from the specifics: the victims are exactly the tools people run to self-host models, and one of the exploited flaws was already on CISA's KEV list with an available patch.
The substance
Everything load-bearing here traces to Lumen's own reporting. The operation, which Lumen calls Canto Incognito, started with a compromised Ivanti Sentry server that researchers encountered in June while investigating CVE-2026-10520. Telemetry places the first poem commit on April 13, 2026. Infected hosts run XMRig and Iron miners pointed at the Kryptex pool, and they are recycled as scanners, which is how the botnet compounds. One earlier poem version encoded the address 92.119.165.74 through the words "driver," "diode," "decryption," and "string" (Lumen report).
Two scope points deserve precision. First, this is a cryptomining and scanning operation, not an AI-powered attack; Lumen's Ryan English told CyberScoop that what the actor achieves beyond exploit scanning and cryptomining remains under investigation, though the malware's remote-code-execution capability could eventually let an operator abuse the models on victim servers. Second, Lumen has blocked traffic to and from the known C2 servers, so the observed infrastructure is disrupted, but the botnet's size means the advice below still applies to unpatched hosts.
Why builders are watching
An exposed LiteLLM proxy or Ollama runner is not a hypothetical risk; it is the actively exploited attack surface. The hardening steps are the ones prior coverage has already laid out: bind services to localhost rather than 0.0.0.0, authenticate every endpoint, firewall the ports, and patch, starting with the LiteLLM flaw already on CISA's KEV list. The 152,137 exposed Ollama endpoints found in an internet scan earlier this year and the Mysterium incident were warnings; this is the same exposure class with a working exploit chain behind it. Self-hosting keeps data on your hardware, and that is the point of it, but the trade is that you are also the operator now, and operators patch.
Questions
- What is the PoeLLM botnet?
- PoeLLM is the name Lumen's Black Lotus Labs gave to malware in the Canto Incognito campaign: a cryptomining botnet that has compromised more than 3,400 internet-exposed servers since April 2026 by exploiting vulnerable LiteLLM, Ollama, Gitea, and Gotenberg instances, mining cryptocurrency on them, and recycling them to scan for new victims.
- How did the malware hide its command-and-control address?
- The operator stored a poem titled 'On the Nature of Connection' in a GitHub repository. PoeLLM extracts four specific words from the poem, maps them to numbers through a hard-coded dictionary, and combines them into the current C2 IPv4 address. Eleven poem edits since April 13 each moved victims to a new server without any malware update.
- Is this evidence of AI-powered attacks?
- No. Lumen's research describes cryptomining, exploit scanning, and early-stage brute-force experimentation. The victims are AI-adjacent because they run AI infrastructure, not because the attacks use AI. The malware can execute remote code, which Lumen flags as potential future abuse of the models themselves, but that has not been observed at scale.
Sources
- PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem — CyberScoop
- Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers — Help Net Security
- Canto Incognito: Tracking the PoeLLM malware — Lumen Black Lotus Labs
- X post relaying the PoeLLM botnet findings (@OWASPHyderabad) — X
- X post relaying the PoeLLM botnet findings (@tchsignal) — X
About DeAI
DeAI is an independent publication covering open-weight AI models, private inference, and decentralized infrastructure — the tools for running AI you actually control. We test providers on price, privacy, and refusal behavior and publish the numbers, not the vibes. DeAI is powered by Morpheus (mor.org), a decentralized inference marketplace, and covers it on the same terms as every other provider.
Powered by Morpheus and StrandCMS
Morpheus is a decentralized inference marketplace, covered on the same terms as every other provider — we rank it wherever the data lands. StrandCMS is the open-source, agent-first framework this site is built on.