A cryptomining operation has deployed PoeLLM malware against publicly accessible AI infrastructure, converting compromised machines into reconnaissance platforms and attack staging grounds. The campaign has infected more than 3,400 servers, with daily active infections peaking at around 800 systems, according to researchers at Lumen's Black Lotus Labs (BLL).
The malware employs a distinctive approach to obtain C2 infrastructure: it extracts keywords from a poem titled "On the Nature of Connection" hosted in a GitHub repository and maps those words to numerical values using an embedded dictionary, ultimately constructing IPv4 addresses for command servers. Since April, the operation has established at least 11 C2 servers, with the operator updating the poem 11 times to rotate infrastructure.
Victims span the United States and Western Europe, predominantly running exposed instances of LiteLLM, Ollama, Gotenberg PDF converter, and Gitea development toolkit. Researchers also detected targeting attempts against Ivanti Sentry systems. BLL notes that AI and LLM deployments present attractive targets because they frequently suffer from misconfigurations, internet accessibility, and run on GPU-intensive hardware ideal for mining operations.
Infection chain and capabilities
PoeLLM, distributed as an ELF binary named libgcrypt, incorporates remote shell access, XMRig and Iron cryptocurrency miners, HTTP/HTTPS port scanning, and exploit deployment functionality. Once installed, infected servers become distribution nodes for lateral movement, scanning ports 3000 and 4000 associated with Gotenberg and LiteLLM while attempting to exploit CVE-2026-42271.
The CVE-2026-42271 vulnerability affects LiteLLM's MCP server test endpoints. Originally disclosed as requiring authentication and rated high-severity, researchers at Horizon.ai demonstrated it could be chained with CVE-2026-48710 to achieve unauthenticated remote code execution. Infected systems subsequently connect to Kryptex, a Russian cryptocurrency mining service.
Infrastructure analysis revealed that several C2 servers hosted vulnerable router administration interfaces, indicating the attacker likely repurposed compromised network devices. While attribution remains uncertain, BLL assesses with moderate confidence that the operator is Italian, based on code comments and a server hosting the administrative panel located in Italy.
Mitigation recommendations
- Apply latest security patches and updates
- Minimize public internet exposure for critical systems
- Restrict external access to trusted IP addresses only
- Review network monitoring logs for connections to indicators of compromise published by Black Lotus Labs