Blog Cybersecurity
PoeLLM Botnet Hits Exposed AI Servers: Check Your Risk
On this page· 8 sections
On October 7, 2026, Lumen’s Black Lotus Labs reported a botnet called PoeLLM that has infected more than 3,400 servers since April. Many of them were exposed AI servers, such as unpatched LiteLLM and Ollama deployments, quietly put to work mining cryptocurrency for someone else.
What happened with PoeLLM
According to BleepingComputer, the campaign, dubbed Canto Incognito, has been active since at least April 2026. Victims are concentrated in the United States and Western Europe. The 3,400 figure is a running total. At its peak, around 800 infected servers were active in a single day, and The Hacker News notes that by mid-June the campaign involved almost 2,200 affected servers.
It is not only AI tools in the crosshairs. Besides LiteLLM and Ollama, hundreds of Gotenberg (PDF conversion) and Gitea (code collaboration) servers were hit, as summarized by Help Net Security. The researchers first stumbled on the infrastructure while investigating a flaw in Ivanti Sentry.
One honest caveat before going further: all three sources place the victims in the United States and Western Europe, and we found no report naming organizations in Indonesia. But the weakness being abused does not care about borders. An open, unpatched server can be found by automated scanners wherever it sits.
A poem as a hidden signpost
The part that made this story travel is how PoeLLM hides the address of its control server. Malware usually carries that address inside its code or uses a domain name that defenders can block. PoeLLM does something different.
It reads four keywords from a poem titled “On the Nature of Connection,” stored in a file called dash.css in a GitHub repository. A dictionary built into the malware turns those four words into numbers, and the numbers form the IP address of the control server. When the operator wants to move victims to a new server, they just edit a few words in the poem. According to Help Net Security, the poem was edited 11 times after its first commit on April 13, 2026.
It is a clever trick because the traffic looks like ordinary access to GitHub, which millions of developers use every day. There is no suspicious domain to drop onto a blocklist. One more point worth stating plainly: this is a way of hiding an address, not an AI being talked into something by verse. It was the malware reading the text, not a model. The Hacker News reports that the GitHub repository is no longer accessible, but the pattern can be copied by anyone, with a different file on a different popular service next time.
How a server gets infected
The flow is simple. An infected server scans the internet, mostly ports 3000 and 4000, which Gotenberg and LiteLLM commonly use. When it finds a target, it tries to exploit CVE-2026-42271, a command injection flaw in a LiteLLM MCP server test endpoint. A compromised server is told to download a file from the control server, then installs the XMRig and Iron miners, which connect to the Kryptex mining service.
From there, the new victim starts scanning and attacking others. That is why one unpatched server is not just your own problem: it becomes part of the machinery that spreads the botnet.
Why cryptomining still matters
Silent mining can sound like it only steals electricity and computing power. For an organization the impact goes further. Servers slow down for no clear reason, cloud or power bills creep up, and above all, an intruder already has a foothold. The malware also includes a remote shell, so the same access could in principle be used for something else. Help Net Security even notes early attempts at SSH and login-portal password guessing in more recent activity.
Why this matters in Indonesia
Many schools, universities, and government offices are starting to try AI on their own. An IT teacher installs Ollama on a school server to test a question-drafting assistant. A data team at a regional office runs LiteLLM so several apps can share one gateway to different AI models. That is reasonable, even good work. The trouble is that experiments like these are often set up fast, opened to the internet so people can reach them from home, and then forgotten.
Forgotten test servers are a botnet’s favorite target. Nobody is monitoring them, nobody has scheduled updates, and sometimes nobody remembers who owns them. Automated scanners do not care whether a server belongs to a large company or a vocational school’s computer lab. We previously covered how attacks are getting faster and patch windows shorter in AI-Powered Cyberattacks. PoeLLM shows the other side: the AI tools you install yourself join the list of things that need patching.
What this means for your organization
Black Lotus Labs, via Help Net Security, recommends including AI tools in attack surface management and patch cycles, just like any other server. In practice, you can start with five things.
Find out what is exposed. List every AI and developer service running in your organization, including the ones installed “just to try.” Ask around, because there are often servers nobody wrote down. Then check from outside your network whether each one can be reached from the internet.
Close public access you do not need. BleepingComputer’s advice is clear: reduce internet exposure and restrict access to trusted addresses only. If a service is only used from the office or school, a VPN or internal network is enough.
Update, then schedule it. Apply the latest security updates to LiteLLM, Ollama, and companion tools like Gotenberg and Gitea. After that, put it on a regular calendar, say monthly, with a named owner.
Put a fence around access. AI services should require authentication, avoid default credentials, and never keep model API keys where they are easy to read.
Watch for subtle signs. Sustained high processor load, a jump in bills, or unfamiliar outbound connections are early clues. Also check your network logs against the indicators of compromise that Black Lotus Labs has published.
If you suspect a server in your organization is already exposed, there is no need to panic. Start with the easiest step: restrict access today, update tomorrow. For a thorough check, our team offers cybersecurity services and guidance through our artificial intelligence services, so AI tools are set up safely from day one. We also discuss whether to run tools yourself or use a managed service in SaaS vs Self-Hosted.
Frequently asked questions
Can a cryptominer on a server be detected?
Yes, though not always easily. The usual signs are high CPU or GPU use with no clear workload, a server that feels sluggish, and outbound connections to a mining service. Monitor basic metrics and set a sensible threshold so unusual spikes stand out quickly.
Does using Ollama or LiteLLM mean being unsafe?
No. The tools themselves are not the problem. The risk appears when old versions are left running and the service is open to the internet without restrictions. With regular updates and limited access, these tools can be used with reasonable confidence.
Is blocking the published list of malicious addresses enough?
It is a useful step, but not enough. The researchers explain that PoeLLM builds its control address from ordinary-looking text, and the operator has already moved it 11 times. A blocklist is always one step behind. Closing the hole and limiting exposure lasts much longer.
Closing thoughts
This story is a reminder of something easy to forget: every AI tool we install is a server that needs care. No complicated program is required. It is enough to know what is running, who owns it, and when it was last updated. If you would like to talk it through, feel free to contact us, no pressure.
