PoeLLM Malware Botnet Compromises More Than 3,400 Servers via GitHub Poem

PoeLLM malware has assembled a botnet of more than 3,400 servers since April by using a poem on GitHub as a dynamic command and control lookup table. Lumen Technologies' Black Lotus Labs disclosed the campaign Wednesday. The poem looks harmless. It has no links, no files to download, and no encrypted text. That is exactly why it works.

A Poem That Points to a Server

Four words, one address

The malware extracts four specific words from the poem. Those words have been changed at least a dozen times. Each word is matched against a hardcoded dictionary embedded in the malware, and because individual words map to sets of IP addresses, four numbers then combine to form the current command and control server address. So it's simple. They're just words. But we've seen this before. You can't ignore it.

The first stanza of the poem observed last month reads:

In the silent hum of driver, the machines begin to speak, each pulse of diode threading light through copper veins. We taught the dark to carry meaning, byte by byte, a language built from lightning, cold and clean.

From that verse, the malware extracts words relative to fixed text anchors. As an example:

• "driver" maps to 92
• "diode" maps to 119
• "decryption" maps to 165
• "string" maps to 74

Change the poem's keywords and the malware automatically calculates a new address without needing to update itself.

Why it evades detection

A poem with no links, no files, and no encrypted content ought to be harmless. Sounds harmless. And that's exactly the problem. It's that appearance, the innocent surface that gives nothing away, that makes PoeLLM malware so difficult to trace, because nothing on the page looks like a threat and nothing in the file screams for attention. Ryan English, information security engineer at Black Lotus Labs, explained what makes the method unusual.

The most interesting piece of the poem approach is that the IP address used for C2 communications is invisible outside of the victim's netflow. In other malware samples, there might be a hardcoded fallback C2 address, or URL which points to an IP address written elsewhere on the internet.

English added something simple. To anyone who comes across it, this is just a poem on GitHub. There'd be no reason for any security researcher to identify this poem as malicious, or know about the IP address hidden within it, unless they had access to the malware referencing it. That's it.

Ivanti Sentry Led to a Bigger Find

It started with Sentry. Ivanti's Sentry secure mobile gateway, that is. Researchers first encountered PoeLLM infrastructure in June while investigating a maximum severity defect affecting Sentry, and what they uncovered was an expansive exploit scanning and cryptocurrency mining botnet linked to several compromised services and tools. And they're still piecing it together. It's a lot. We've got questions. They don't have all the answers.

• LiteLLM
• Ollama
• Gotenberg
• Gitea

PoeLLM malware contains functionality for remote code execution. That could allow the actor to abuse AI models on victim servers and use public facing services for downstream compromise.

A Private Army of Proxies

The botnet has continued to grow by converting compromised servers into attackers and shifting through command and control infrastructure. That leaves fewer traces across the internet. English said that the actor has effectively created a private army of AI-enabled proxies.

Through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more.

One exploit server gets reported. That's all it takes. The attacker can easily pivot and start proxying attacks through hundreds of other compromised victims, which means the security community's takedown of a single box does almost nothing to slow the campaign down. Many of the command and control servers used in this campaign were never detected on crowd-sourced security tools. And English said that shows how helpful the obfuscation layer has been.

Who Is Behind PoeLLM Malware?

The actor is likely Italian or speaks Italian. Researchers observed multiple comments in the malware code written in Italian, and the operation relied on Italy-based servers for testing and command and control infrastructure.

What remains unknown

Black Lotus Labs doesn't know how many people are involved in the PoeLLM malware operation. No connections to other groups or campaigns have been observed. And English said PoeLLM has been extremely successful in compromising multiple AI-related services at scale, but the actor's achievements beyond exploit scanning and cryptomining remain under investigation, which means we've still got a lot to learn. It's unclear.

Frequently Asked Questions

What is the PoeLLM malware botnet and how does it use a GitHub poem?

PoeLLM malware has assembled a botnet of more than 3,400 servers since April by using a poem on GitHub as a dynamic command and control lookup table. The malware extracts four specific words from the poem and matches each word against a hardcoded dictionary embedded in the malware, and because individual words map to sets of IP addresses, four numbers then combine to form the current command and control server address. The poem looks harmless, with no links, no files to download, and no encrypted text, which is exactly why it works.

Why does the PoeLLM malware's poem approach make it so difficult to detect?

A poem with no links, no files, and no encrypted content ought to be harmless, and that innocent surface gives nothing away, making PoeLLM malware so difficult to trace. Ryan English, information security engineer at Black Lotus Labs, explained that the IP address used for C2 communications is invisible outside of the victim's netflow. He added that to anyone who comes across it, this is just a poem on GitHub, and there'd be no reason for any security researcher to identify it as malicious unless they had access to the malware referencing it.

How did researchers first discover the PoeLLM malware infrastructure?

Researchers first encountered PoeLLM infrastructure in June while investigating a maximum severity defect affecting Ivanti's Sentry secure mobile gateway. What they uncovered was an expansive exploit scanning and cryptocurrency mining botnet linked to several compromised services and tools, including LiteLLM, Ollama, Gotenberg, and Gitea. PoeLLM malware contains functionality for remote code execution, which could allow the actor to abuse AI models on victim servers and use public facing services for downstream compromise.

Who is likely behind the PoeLLM malware operation, and what remains unknown about the actor?

The actor is likely Italian or speaks Italian, as researchers observed multiple comments in the malware code written in Italian, and the operation relied on Italy-based servers for testing and command and control infrastructure. Black Lotus Labs doesn't know how many people are involved in the PoeLLM malware operation, and no connections to other groups or campaigns have been observed. English said PoeLLM has been extremely successful in compromising multiple AI-related services at scale, but the actor's achievements beyond exploit scanning and cryptomining remain under investigation.

How does the PoeLLM botnet continue to grow and evade takedown efforts?

The botnet has continued to grow by converting compromised servers into attackers and shifting through command and control infrastructure, which leaves fewer traces across the internet. English said that through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more. Many of the command and control servers used in this campaign were never detected on crowd-sourced security tools, and English said that shows how helpful the obfuscation layer has been.