PoeLLM: malware that farms exposed ai servers and takes orders from a poem

Lumen's Black Lotus Labs has published a report, "Canto Incognito", on a botnet it calls PoeLLM.

What it does

• It has infected more than 3,400 servers since April 2026, with more than 800 active on its busiest days.
• It targets exposed ai infrastructure: LiteLLM gateways and Ollama servers, along with Gotenberg, Gitea and possibly Ivanti Sentry.
• It mines cryptocurrency on the hijacked machines and uses them to scan for new victims.

The poem

To find its command server, the malware reads four words from a poem in a GitHub repository. A built-in dictionary turns those words into an IP address. To move servers, the operator just edits the poem, which has been changed at least a dozen times. To anyone watching the network, it looks like someone reading a text file.

Lumen believes, with moderate confidence, that the operator is a financially motivated Italian speaker. It has blocked the command servers.

Why it matters

Companies that set up their own model servers to keep data in house have also built something a stranger can find, borrow and quietly rent out. Exposed ai gateways are now a target in their own right: free GPUs and a launch point for the next attack.