Poem C2 resolution
A way for malware to find its command server without hard-coding an address. poellm downloads a poem from a file with a CSS-style name inside a forked Node.js repository on GitHub. It takes four words or phrases from fixed positions, looks each up in a built-in dictionary, and combines the resulting numbers into an IPv4 address (gadgetreview-poellm-botnet).
What it buys the attacker
- Redirection without redeploying. Edit the poem and every bot follows. The first relevant commit is dated 2026-04-13 and the text has been edited several times since.
- Benign-looking traffic. A fetch from GitHub of a text file is ordinary traffic, and a poem tells a human reviewer nothing.
- The article compares it to a QR code that changes destination while looking the same.
What it is not
No AI model reads or interprets the poem. The malware parses the text mechanically. "Adversarial poetry" is the researchers' label, and the name is the only AI link. Do not cite this as AI-in-the-loop malware.
Defender angle
The address is only recoverable by someone who has the dictionary and word positions, so reverse engineering the sample is the route to the C2 list. The poem's edit history in git is a dated record of every redirect. Blocking the C2 IPs works only until the next edit; egress control and watching for mining-pool connections do not depend on the address. Single source, no data on how many families use this pattern.
Related
poellm · black-lotus-labs · gadgetreview-poellm-botnet · network-traffic-analysis