PoeLLM Cryptominer Hits 3,400 Servers Using GitHub Poem for C2 Communication

Lumen’s Black Lotus Labs reported that the PoeLLM cryptomining malware has infected more than 3,400 servers. The research team identified this widespread campaign targeting exposed artificial intelligence tools, highlighting a growing trend of attackers leveraging AI infrastructure for illicit mining operations.

The malware primarily targets exposed AI inference platforms, specifically LiteLLM and Ollama. According to Tom's Hardware, these tools are frequently left unprotected on public networks, allowing attackers to deploy the cryptominer without authentication. The sheer volume of compromised servers indicates a highly automated scanning and exploitation process.

Operational Mechanics

The PoeLLM malware uses a unique method to locate its command-and-control infrastructure. Instead of hardcoding server addresses, the malicious code retrieves configuration details from a poem hosted on GitHub. This technique allows attackers to change their control servers by simply updating the text of the poem, making it difficult for defenders to block static domains.

This dynamic resolution method adds a layer of resilience to the malware. Security researchers noted that the poem serves as a configuration file, directing infected machines to the active mining pools. This approach bypasses traditional blocklists that rely on known malicious URLs or IP addresses.

Targeted Infrastructure

Most of the compromised servers were running LiteLLM or Ollama, two popular tools for deploying large language models. According to Tom's Hardware, these applications are often exposed to the internet without proper security controls. Attackers scan for these specific ports and services to identify vulnerable targets quickly.

The exposure of these AI tools creates a significant attack surface for cryptominers. Because LiteLLM and Ollama are designed for ease of use, many administrators neglect to implement network segmentation or authentication. This negligence allows the PoeLLM malware to execute commands and begin mining cryptocurrency immediately upon access.

What should you do?

Organizations should audit their network for exposed AI inference tools like LiteLLM and Ollama. Administrators must ensure these services are not accessible from the public internet without strict authentication. Monitoring system performance for unusual CPU usage can also help detect active cryptomining processes.

Background: Large language models

Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.

Read the full guide: Large Language Models vs Generative AI: The Distinction and Security Implications

What to do and how to stay safe: PoeLLM

• Scan internal networks for exposed instances of LiteLLM and Ollama.
• Implement strict firewall rules to block unauthorized access to AI inference ports.
• Monitor server resource usage for sudden spikes indicative of cryptomining.
• Review GitHub repositories for any unusual configuration files or scripts.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is PoeLLM malware?

PoeLLM is a cryptomining malware that targets exposed AI tools like LiteLLM and Ollama, using a GitHub poem to locate its command-and-control servers.

How many servers have been infected?

According to Lumen's Black Lotus Labs, the malware has infected more than 3,400 servers globally.

Why is a poem used in the attack?

The poem hosted on GitHub acts as a dynamic configuration file, allowing attackers to update command-and-control server locations without changing the malware code.