Gadget Review: PoeLLM botnet hides its C2 address in a GitHub poem

C. da Costa, Gadget Review, 2026-10-08. A three-minute trade-press report of black-lotus-labs' "Canto Incognito: Tracking the PoeLLM Malware." It describes poellm, a profit-driven botnet that has compromised more than 3,400 servers running AI and developer tools, and the odd way it finds its command server: poem-c2-resolution.

Tier T2. Journalism, but it cites a named threat-intel team's primary research (linked in the article) and adds little of its own; the claims trace to Black Lotus Labs, not to the reporter. Not T1 because the primary report was not the thing ingested. The article also credits Help Net Security, The Register, The Hacker News and CyberScoop for parts of the story.

What it says

• 3,400+ servers compromised, about 800 active on the busiest day. Active since at least April 2026 and still adding victims in October 2026.
• Infected hosts run XMRig and Iron miners tied to Kryptex infrastructure, and scan for and exploit new targets. GPU servers are the attractive ones.
• Targets: LiteLLM, Ollama, Gotenberg, Gitea, and an Ivanti Sentry appliance noticed because an infected unit scanned outward from it.
• The command server's IPv4 address is derived from words in a poem in a GitHub repository; editing the poem redirects the bots with no change to the malware. First relevant commit 2026-04-13.
• No AI model reads the poem. The article is explicit that malware parsed the text. "Adversarial poetry" is the researchers' name for the technique.
• Attribution: moderate confidence, a suspected Italian-speaking operator, based on Italian-language artifacts and network-flow analysis; a GitHub account ejejejdfbbebe is named. The article says this is not a confirmed identity.
• Advice: keep AI and developer tools off the open internet without strong access control, patch, watch outbound traffic to mining pools, separate GPU and model-serving systems, and treat any fetched document or page as untrusted input.

Weaknesses to carry

• Victim count. A fetch of the primary Lumen post (read through a summarizer, so unverified here) shows its key takeaways say 3,400+ victims while its body says "almost 2,200." The article repeats the larger figure. Treat 3,400 as the headline claim and the count as unsettled.
• The advice list is generic hygiene; no evidence offered for which item matters most.
• Secondary source; the primary report was not read in full.

Cross-spoke context

The campaign's victims are exposed AI infrastructure, which touches ../agentic-tooling-wiki (LiteLLM, Ollama as tooling) and ../llm-providers-wiki. The subject here is the botnet and its command channel, so nothing is written into those spokes.

Related

poellm · poem-c2-resolution · black-lotus-labs · defensive-security · network-traffic-analysis