Black Lotus Labs traced PoeLLM activity beginning in April 2026 against internet-exposed LiteLLM, Ollama and other AI-related and open-source services. Its samples and network telemetry showed crypto miners, C2 routing through an encoded GitHub poem, and compromised hosts recruited to scan or exploit further systems. The report’s opening says more than…
Inspect the ClaimsCase · DiggingBeagle record
PoeLLM malware exploited exposed AI services and used GitHub poem text for command routing
Lumen linked a mining and scanning botnet to vulnerable exposed AI and developer services, including a LiteLLM endpoint, while its report contains conflicting cumulative victim totals.
Scope
Observed PoeLLM botnet from April through early October 2026; exposed AI services were among several targeted technologies.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Lumen Black Lotus Labs reports live C2 traffic, malware samples, victim netflow and exploitation of exposed AI-related services. Its opening cumulative >3,400 host figure and later ~2,200 cumulative phrase have not been reconciled, although another paragraph correctly labels ~2,200 as mid-June peak. No claim of AI-operated malware is justified.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-POE-AI-TARGETS · CLM-POE-POEM-C2 · CLM-POE-NUMERIC-CONFLICT · CLM-POE-JUNE-PEAK · Lumen Black Lotus Labs: Canto incognito, tracking PoeLLM malware
At a glance
Restricting direct public exposure of LiteLLM, Gotenberg and other administrative service ports, patching the exploited endpoints, and monitoring documented C2 indicators break the conventional intrusion path. The attacker reused ordinary server vulnerabilities and compute access; the presence of an AI-serving workload does not establish AI-originated…
Read the implicationsWhether the greater-than-3,400 figure and the later almost-2,200 cumulative description refer to different snapshots, filters or a textual error; the original report gives no common measurement method. Precise per-product counts of confirmed exploit delivery versus mere C2 network contacts. Exact patch deployment among affected LiteLLM and Ollama…
Limits and uncertaintyFull account
Black Lotus Labs traced PoeLLM activity beginning in April 2026 against internet-exposed LiteLLM, Ollama and other AI-related and open-source services. Its samples and network telemetry showed crypto miners, C2 routing through an encoded GitHub poem, and compromised hosts recruited to scan or exploit further systems. The report’s opening says more than 3,400 servers were impacted and describes peak daily activity over 800. A growth-section paragraph separately describes almost 2,200 affected hosts at the mid-June peak, whereas another technical paragraph says almost 2,200 were affected since April. Those phrases differ in their measurement windows and one apparently conflicts with the headline total; the publication does not provide sufficient definitions to reconcile them. Neither count should be presented as a verified number of AI-model compromises. Here AI systems were targets hosting vulnerable conventional software, rather than autonomous attacking agents.
Mechanism and trust boundary
- 01
Internet-exposed service
Attacker targeted vulnerable service endpoints including LiteLLM and deployed PoeLLM to reachable hosts.
Boundary: Publicly reachable application surface to operating-system execution
- 02
Botnet recycling
Infected hosts mined cryptocurrency and were used to scan or exploit additional exposed services.
Boundary: Compromised server to attacker-controlled remote workload
Claims & evidence
CLM-POE-POEM-C2Lumen describes a command-and-control scheme that converts changing phrases in a public GitHub poem into malware server addresses.supported
Basis: reported finding
- supportsLumen Black Lotus Labs: Canto incognito, tracking PoeLLM malwareprimary disclosure
PoeLLM targets exposed AI infrastructure; C2 framework description
CLM-POE-JUNE-PEAKLumen reported almost 2,200 affected servers at the mid-June campaign peak, with nearly 800 active per day, while the headline reported more than 3,400 impacted hosts over a wider reporting window.supported
Basis: reported finding
- supportsLumen Black Lotus Labs: Canto incognito, tracking PoeLLM malwareprimary disclosure
Tracing PoeLLM’s discovery and botnet growth, mid-June peak; Key takeaways, cumulative growth
CLM-POE-AI-TARGETSLumen Black Lotus Labs reports PoeLLM exploiting exposed services including LiteLLM, repurposing compromised servers for cryptocurrency mining and further scanning.supported
Basis: reported finding
- supportsLumen Black Lotus Labs: Canto incognito, tracking PoeLLM malwareprimary disclosure
PoeLLM targets exposed AI infrastructure; exploitation and botnet sections
CLM-POE-NUMERIC-CONFLICTThe Lumen report says more than 3,400 servers were affected in its Key takeaways, but later describes almost 2,200 servers as impacted since April. A separate paragraph calls almost 2,200 the mid-June peak; the conflicting cumulative wording and measurement windows remain unexplained.supported
Basis: reported finding
- supportsLumen Black Lotus Labs: Canto incognito, tracking PoeLLM malwareprimary disclosure
Key takeaways, impacted more than 3,400; Tracing PoeLLM, mid-June peak paragraph; technical campaign section, since it first emerged in April almost 2,200
Implications
Restricting direct public exposure of LiteLLM, Gotenberg and other administrative service ports, patching the exploited endpoints, and monitoring documented C2 indicators break the conventional intrusion path. The attacker reused ordinary server vulnerabilities and compute access; the presence of an AI-serving workload does not establish AI-originated attacks or prompt injection.
Unknowns and contradictions
- Whether the greater-than-3,400 figure and the later almost-2,200 cumulative description refer to different snapshots, filters or a textual error; the original report gives no common measurement method.
- Precise per-product counts of confirmed exploit delivery versus mere C2 network contacts.
- Exact patch deployment among affected LiteLLM and Ollama environments, and campaign adaptation after the reported C2 blocks.
Sources and citation
Material revision history
- Oct 11, 2026 · Published version · first publication · revision 123