Threat intel

Black Lotus Labs, the threat research team at Lumen, has published research on PoeLLM, a cryptomining botnet that has compromised more than 3,400 servers since April 2026. Most victims run self-hosted AI services such as the LiteLLM gateway and the Ollama model server, with hundreds more running the Gotenberg PDF converter and the Gitea code hosting platform. At its busiest the botnet had about 800 infected machines active on a single day, mostly in the United States and Western Europe.

The unusual part is how infected machines find their controller. PoeLLM reads a poem from a file in a GitHub repository, picks out four words and turns them into an IP address. The operator has moved the botnet to a new command-and-control (C2) server 11 times by editing the poem, without touching the malware. If you run LiteLLM older than 1.83.7 on a reachable port, or any of these tools open to the internet, check it this week.

How it gets in

The confirmed entry point is CVE-2026-42271 in LiteLLM, an open-source proxy that gives applications one API in front of many model providers. LiteLLM can connect to Model Context Protocol (MCP) servers, which expose tools to a model. Two admin endpoints, POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list, let a user preview an MCP server before adding it.

Those endpoints accepted a full server definition, including the stdio type, where LiteLLM starts the MCP server as a local process. In versions 1.74.2 to 1.83.6 they only checked for a valid proxy API key and never checked the caller's role. Any key holder, including a low-privilege internal user, could send a "server" whose command was a shell line, and LiteLLM ran it with the proxy's own privileges. The flaw is rated CVSS 8.7 (version 4.0; 8.8 under version 3.1).

Horizon3.ai showed the key requirement can be removed. Chained with CVE-2026-48710, a host header flaw in Starlette (the Python web framework LiteLLM uses), the same endpoint gives remote code execution with no key at all. LiteLLM 1.83.7 both restricts the test endpoints to the PROXY_ADMIN role and updates the Starlette dependency. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities (KEV) catalog on June 8, 2026.

In the sample Black Lotus Labs analysed, the exploit server sent a crafted POST to /mcp-rest/test/connection that told the victim to download a file from the C2. The researchers did not name a flaw for the Ollama, Gotenberg and Gitea victims. Lumen's advice to keep Gotenberg's API behind a firewall, as the vendor recommends, suggests those victims were reached through exposure rather than a bug.

How the poem becomes an address

The payload is an ELF binary named libgcrypt, the same name as a real Linux crypto library, which makes it easy to miss in a process list. It fetches a file called dash.css from a GitHub repository owned by the user ejejejdfbbebe, a fork of the nodejs.org website source. The file holds a two-stanza poem titled "On the Nature of Connection". Node.js itself has nothing to do with the campaign.

The malware extracts four words from fixed places in the poem, for example the text between "In the silent hum of " and the next comma. A dictionary hard-coded in the binary maps each word to a number from 0 to 255, and the four numbers form an IPv4 address. In a June 23 sample, "driver", "diode", "decryption" and "string" became 92.119.165.74.

The first commit is dated April 13, 2026. Since then the operator has changed only the four keywords, 11 times, and every infected host followed. Blocking one IP buys little, and the lookup itself is ordinary HTTPS to GitHub, which most servers are allowed to reach. The real C2 address only appears in the victim's own network flow records.

What the bots do

Each infected server runs the XMRig and Iron cryptocurrency miners and connects to Kryptex, a Russian mining service. The same binary carries a remote shell, an HTTP and HTTPS scanner and exploit code, so every victim becomes a scanner and exploit server for the next round. In May the scanning focused on TCP ports 3000 and 4000, the defaults for Gotenberg and LiteLLM. Bots beaconed back to the C2 on ports 3778, 5001, 5002 or 9999.

Black Lotus Labs found PoeLLM while investigating CVE-2026-10520 in Ivanti Sentry: in early June a Sentry victim contacted 5.78.73.122, then started scanning. The report treats Sentry as a possible target, not a confirmed one. Several C2 addresses were themselves routers with exposed admin pages, which suggests the operator hosts its controllers on hacked devices. More recently, groups of bots have started trying logins against SSH and other portals, which the researchers read as an early test of distributed brute forcing.

Attribution is loose. Italian comments in the code and an Italy-based server hosting the admin interface give the researchers moderate confidence that the operator is Italian-speaking and in it for money. Counts differ between reports: BleepingComputer first reported 2,100 compromised servers, and Black Lotus Labs later raised its figure to 3,400.

What to do

1. Upgrade LiteLLM to 1.83.7 or later. That release limits both MCP test endpoints to PROXY_ADMIN and pulls in the fixed Starlette. Check with pip show litellm or the image tag of your container.
2. If you cannot upgrade today, block POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list at the reverse proxy or WAF, and review who holds proxy API keys. Remove keys nobody uses.
3. Take Ollama, Gotenberg, Gitea and LiteLLM off the open internet. Bind them to an internal interface or allow only known source IPs on ports 3000, 4000 and Ollama's 11434. Scan your own external ranges for those ports; AI tools installed by a data team are often missing from the asset list.
4. Hunt on hosts. Look for a process or file called libgcrypt running from an unusual path (the real library is a shared object such as libgcrypt.so.20, loaded by other programs and never a process of its own), sustained high CPU, and child processes of the LiteLLM or Gotenberg service.
5. Hunt on the network. Look for outbound connections to Kryptex mining pool hosts, to GitHub from servers with no reason to fetch from it, and to the C2 addresses Black Lotus Labs lists. Those it reported active at publication were 92.119.164.50, 103.249.201.108 and 178.128.14.204; earlier ones include 5.78.73.122 and 92.119.165.74. Its full indicator list is on the Black Lotus Labs GitHub.
6. If you find a hit, rebuild the host from a clean image rather than killing the miner. The bot has a remote shell, so assume the attacker could read anything the service could. Rotate every model provider API key, LiteLLM master and virtual keys, and database credentials stored on the proxy.

AI servers belong in the patch cycle

LiteLLM keys open paid model accounts, and Gitea holds source code and deploy tokens. These tools are often installed by an engineering team to try something out and never reach the team that patches servers. PoeLLM did not need anything clever to get in: a fix released in May and a KEV listing in June did not stop it growing past 3,400 servers. Put self-hosted AI tools on the same inventory, exposure scan and update schedule as your web servers.

Our attack surface management work finds services like these on your external ranges before a scanner does, and AI-native systems covers hardening LiteLLM, Ollama and similar stacks. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

---

Sources: Black Lotus Labs, Canto Incognito: Tracking the PoeLLM malware, Help Net Security, BleepingComputer, SecurityWeek, In Other News, October 9, 2026, Wiz, CVE-2026-42271, Help Net Security, LiteLLM flaw under active attack.