Key points
- Lumen's Black Lotus Labs confirmed the PoeLLM cryptominer has compromised more than 3,400 servers globally.
- The majority of infected systems ran exposed AI tools, specifically LiteLLM and Ollama, which lacked proper authentication.
- Attackers utilized a GitHub-hosted poem to hide control server locations, obscuring the command-and-control infrastructure.
Lumen's Black Lotus Labs reported that the PoeLLM cryptomining malware has successfully infected more than 3,400 servers, according to Tom's Hardware. The researchers identified this widespread campaign targeting infrastructure that hosts artificial intelligence models, highlighting a growing risk for organizations deploying open-source AI tools without adequate security controls.
The investigation revealed that most of the compromised servers were running exposed instances of LiteLLM and Ollama, popular tools for managing and running local AI models. These services were left accessible to the public internet without authentication, allowing attackers to inject malicious code and install the cryptominer directly onto the host systems.
Operational Context and Tactics
The PoeLLM malware employs a distinct technique to maintain persistence and evade detection by hiding its command-and-control server details within a poem hosted on GitHub. According to Lumen's Black Lotus Labs, the malware retrieves the address of the control server by parsing this specific poem, a method that blends malicious traffic with legitimate code repository activity.
This use of GitHub as a staging ground for control instructions complicates traditional network monitoring, as the traffic appears to originate from a trusted software development platform. The malware then uses these instructions to connect to the actual mining pool, consuming computational resources from the infected servers to mine cryptocurrency for the threat actors.
Affected Systems and Risk Profile
The attack primarily targets system administrators who deploy AI inference engines for testing or production use without implementing network segmentation or access controls. Tom's Hardware notes that the majority of the 3,400+ victims were running LiteLLM or Ollama, indicating that these specific tools are currently high-value targets for automated scanning bots.
Organizations using these tools face significant operational risk, as cryptomining can degrade system performance, increase electricity costs, and potentially serve as a foothold for further lateral movement within the network. The scale of the infection suggests that automated scripts are actively scanning for these specific software signatures on open ports.
Next steps
Security teams should immediately audit their network perimeter for any exposed AI inference endpoints, particularly LiteLLM and Ollama. Administrators must ensure that these services are not publicly accessible and require strong authentication. Organizations should also review firewall logs for unusual connections to GitHub repositories that do not align with standard development workflows.
Background: Threat actors
Threat actors range from criminal syndicates seeking profit to state-sponsored groups aiming for espionage. Each type uses distinct tactics, techniques and procedures (TTPs) driven by their goals. Knowing the difference helps you prioritize alerts and allocate security resources where they matter most.
Read the full guide: Types of Threat Actors: Motives, Methods, and Defense Strategies
What to do and how to stay safe: PoeLLM
- Scan your network for exposed LiteLLM and Ollama instances and restrict access to trusted internal IP addresses only.
- Implement strict authentication mechanisms for all AI inference endpoints to prevent unauthorized code execution.
- Monitor outbound traffic for unusual connections to GitHub repositories that may indicate command-and-control activity.
- Review system resource usage for unexpected spikes that could signal hidden cryptomining processes on your servers.
Step-by-step guide: What Is Ransomware Protection: How to Stop Encryption Attacks
General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI tools are most commonly targeted by the PoeLLM malware?
According to Lumen's Black Lotus Labs, the malware primarily targets exposed instances of LiteLLM and Ollama.
How does the PoeLLM malware communicate with its control server?
The malware locates its control server by parsing a poem hosted on GitHub, using it to hide command-and-control traffic.
How many servers have been infected by this campaign so far?
Researchers report that the PoeLLM cryptominer has hit more than 3,400 servers globally.
