As cited
Copy frozen at (site build).
threat intel
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers since April by targeting open-source artificial intelligence (AI) services, according to Lumen Technologies' Black Lotus Labs. The malware uses a poem posted on GitHub to dynamically generate command-and-control server addresses: it extracts four specific words based on their position in the verse and matches them to a hard-coded dictionary to calculate the IP address, allowing the threat actor to rotate infrastructure without updating the malware code. The botnet conducts exploit scanning and cryptocurrency mining while maintaining functionality for remote code execution and potential abuse of victim AI models, with evidence suggesting the operator is Italian-speaking.
Why it matters: Organizations running open-source AI services (including LiteLLM, Ollama, Gotenberg, and Gitea) face active compromise risk; the botnet's stealth method and ability to proxy attacks through compromised servers create downstream exposure for credential theft and lateral movement.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers since April by targeting open-source artificial intelligence (AI) services, according to Lumen Technologies' Black Lotus Labs. The malware uses a poem posted on GitHub to dynamically generate command-and-control server addresses: it extracts four specific words based on their position in the verse and matches them to a hard-coded dictionary to calculate the IP address, allowing the threat actor to rotate infrastructure without updating the malware code. The botnet conducts exploit scanning and cryptocurrency mining while maintaining functionality for remote code execution and potential abuse of victim AI models, with evidence suggesting the operator is Italian-speaking.
Why it matters: Organizations running open-source AI services (including LiteLLM, Ollama, Gotenberg, and Gitea) face active compromise risk; the botnet's stealth method and ability to proxy attacks through compromised servers create downstream exposure for credential theft and lateral movement.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem
PoeLLM malware has compromised over 3,400 servers since April by targeting open-source artificial intelligence (AI) services, according to Lumen Technologies' Black Lotus Labs. The malware uses a poem posted on GitHub to dynamically generate command-and-control server addresses: it extracts four specific words based on their position in the verse and matches them to a hard-coded dictionary to calculate the IP address, allowing the threat actor to rotate infrastructure without updating the malware code. The botnet conducts exploit scanning and cryptocurrency mining while maintaining functionality for remote code execution and potential abuse of victim AI models, with evidence suggesting the operator is Italian-speaking.
Why it matters: Organizations running open-source AI services (including LiteLLM, Ollama, Gotenberg, and Gitea) face active compromise risk; the botnet's stealth method and ability to proxy attacks through compromised servers create downstream exposure for credential theft and lateral movement.
- Source published
- First seen by Cybersecurity Tracker