Since April 2026, the PoeLLM malware campaign has targeted exposed AI/LLM and open-source services such as LiteLLM, Ollama, Gotenberg, and Gitea. It uses a novel command-and-control method where infected systems extract C2 server addresses from keywords embedded in a poem on GitHub. The malware deploys cryptocurrency miners (XMRig and Iron) connecting victims to Kryptex mining infrastructure. Compromised hosts are also used as scanners and exploit servers to grow the botnet, which has affected over 3,400 servers with up to 800 active daily. The campaign is linked to an Italian-speaking threat actor and mainly impacts victims in the United States and Western Europe. Vulnerable routers are exploited to serve as C2 infrastructure.
