Lumen Black Lotus Labs: Canto incognito, tracking PoeLLM malware

Evidence record

Investigation of an observed mining and scanning malware campaign against exposed AI and developer services; headline and body use irreconcilable cumulative victim counts.

Read the original source ↗

Claim-level citations (4)

• supportsPoeLLM malware exploited exposed AI services and used GitHub poem text for command routing: Lumen describes a command-and-control scheme that converts changing phrases in a public GitHub poem into malware server addresses.

  PoeLLM targets exposed AI infrastructure; C2 framework description

• supportsPoeLLM malware exploited exposed AI services and used GitHub poem text for command routing: Lumen reported almost 2,200 affected servers at the mid-June campaign peak, with nearly 800 active per day, while the headline reported more than 3,400 impacted hosts over a wider reporting window.

  Tracing PoeLLM’s discovery and botnet growth, mid-June peak; Key takeaways, cumulative growth

• supportsPoeLLM malware exploited exposed AI services and used GitHub poem text for command routing: Lumen Black Lotus Labs reports PoeLLM exploiting exposed services including LiteLLM, repurposing compromised servers for cryptocurrency mining and further scanning.

  PoeLLM targets exposed AI infrastructure; exploitation and botnet sections

• supportsPoeLLM malware exploited exposed AI services and used GitHub poem text for command routing: The Lumen report says more than 3,400 servers were affected in its Key takeaways, but later describes almost 2,200 servers as impacted since April. A separate paragraph calls almost 2,200 the mid-June peak; the conflicting cumulative wording and measurement windows remain unexplained.

  Key takeaways, impacted more than 3,400; Tracing PoeLLM, mid-June peak paragraph; technical campaign section, since it first emerged in April almost 2,200