PoeLLM

Everything Threat Times has reported about PoeLLM: 4 stories, newest first. Part of our Cyber Attacks coverage.

Malware & Ransomware

PoeLLM Cryptominer Hits 3,400 Servers Using GitHub Poem for C2 Communication

Threat TimesOct 11, 2026

Lumen researchers report that the PoeLLM malware has infected over 3,400 servers, primarily targeting exposed AI inference tools like LiteLLM and Ollama.

Cyber Attacks

PoeLLM Malware Assembles Botnet of Over 3,400 Compromised Servers

Threat TimesOct 9, 2026

A new malware strain named PoeLLM has compromised thousands of servers, using poetic text to conceal its command-and-control infrastructure coordinates.

Cyber Attacks

PoeLLM Botnet Hides C2 in GitHub Poem, Infects 3,400 Servers

Threat TimesOct 9, 2026

Black Lotus Labs reports a cryptomining botnet using a GitHub poem to hide command-and-control addresses, compromising over 3,400 servers.

AI

PoeLLM malware infects thousands of exposed AI servers for cryptomining

Threat TimesOct 8, 2026

A campaign dubbed Canto Incognito uses PoeLLM malware to hijack exposed AI infrastructure, turning servers into scanners and crypto miners.