By Global Security Desk
Published: October 2023

Executive Summary: The Main Facts

In a startling display of cryptographic creativity and stealth, a newly discovered botnet campaign has successfully compromised more than 3,400 servers globally since April. Dubbed PoeLLM by researchers at Lumen Technologies’ Black Lotus Labs, the malware relies on an unconventional and deeply deceptive command-and-control (C2) mechanism: a seemingly innocent poem published on a public GitHub repository.

Rather than embedding hard-coded IP addresses or relying on domain name generation algorithms (DGA) that can be easily flagged by modern network monitoring tools, PoeLLM extracts specific keywords from a poem to dynamically assemble its C2 server addresses. This creative obfuscation layer has rendered the botnet’s infrastructure virtually invisible to crowd-sourced security tools and conventional threat intelligence feeds.

Targeting open-source artificial intelligence (AI) and development services—including Ollama, LiteLLM, Gotenberg, and Gitea—the campaign has quietly built a robust, self-sustaining network of proxy nodes. While initial observations confirm that the threat actors are utilizing the compromised infrastructure primarily for exploit scanning and cryptocurrency mining, cybersecurity experts warn that the malware’s remote code execution (RCE) capabilities open the door to far more dangerous downstream attacks, including AI model manipulation, credential theft, and API token abuse.

Chronology of an Investigation: From Ivanti Sentry to Poetic C2

The discovery of PoeLLM is the result of meticulous threat hunting and incident response work by security researchers navigating a complex web of overlapping vulnerabilities.

June: The Initial Discovery

The trail began in June, when threat intelligence teams encountered the nascent infrastructure while investigating a maximum-severity security flaw affecting Ivanti’s secure mobile gateway product, Sentry. Digging deeper into the telemetry of compromised assets, analysts uncovered an expansive exploit-scanning and cryptomining botnet that was not just hitting traditional enterprise software, but was specifically probing and seizing control of modern AI microservices and developer environments.

July–August: Uncovering the Mechanism

As researchers reverse-engineered the malware samples collected from infected servers, they noticed a glaring anomaly. Unlike typical malware that communicates with fixed IP addresses or known domains, the PoeLLM samples were reaching out to seemingly random, rotating external locations without any obvious pre-configured configuration files or hard-coded fallback URLs.

By analyzing the binary code, analysts realized the malware was periodically fetching a plain-text file hosted on a public GitHub repository—a poem written by the threat actor. Through a hard-coded internal dictionary and relative positional anchors, the malware parsed specific words out of the poetic text to construct valid IPv4 addresses on the fly.

September–October: Scale and Attribution

By October, telemetry data compiled by Black Lotus Labs revealed that the botnet had expanded past 3,400 distinct server compromises globally. Further code-level analysis began to yield clues regarding the perpetrators. Researchers discovered several internal comments embedded within the malware source code written in fluent Italian, alongside a heavy reliance on Italy-based servers for preliminary testing and infrastructure staging.

Supporting Data and Technical Architecture

The technical sophistication of PoeLLM lies in its decoupled C2 architecture. To understand how the malware operates under the radar, security analysts have broken down its core operational components.

The Anatomy of the Poetic C2

In traditional malware campaigns, if a C2 server is identified, blocked, or taken down by law enforcement, the malware loses its connection, rendering the botnet dormant unless operators quickly push updates. PoeLLM circumvents this vulnerability by decoupling the code from the location.

1. The Source Material: The threat actor maintains a public repository on GitHub containing a benign-looking poem. To an automated vulnerability scanner or a human security analyst, the repository looks like a standard creative writing exercise containing zero malicious payloads, binaries, or encrypted scripts.
2. Dynamic Lookup: The malware periodically polls this GitHub page. Upon retrieving the latest version of the text, it scans for specific word positions relative to fixed textual anchors (such as line breaks or specific introductory phrases).
3. The Stanza Example: For instance, a stanza observed by researchers read:
   

   "In the silent hum of driver, the machines begin to speak, each pulse of diode threading light through copper veins. We taught the dark to carry meaning, byte by byte — a language built from lightning, cold and clean."

4. Dictionary Translation: The malware extracts targeted keywords—such as “driver” and “diode”—and matches them against a hard-coded internal dictionary where every word maps to a specific numerical octet.
5. Address Assembly: These numbers are combined algorithmically to formulate the active C2 IP address. Because the threat actor can alter the poem’s vocabulary at will (a rotation observed more than a dozen times), the C2 address shifts constantly without requiring any binary updates to the deployed malware.

[ GitHub Repository: Poem ]
         │
         ▼ (Malware fetches text)
[ Keyword Extraction & Parsing ]
         │
         ▼ (Matched via hard-coded dictionary)
[ Numerical Octets Generated ]
         │
         ▼ 
[ Active C2 Server Address Formulated Dynamically ]

Targeted Ecosystems

PoeLLM represents a notable evolution in botnet targeting, moving past standard routers, Internet of Things (IoT) devices, and enterprise servers to focus on emerging AI and DevOps stacks. The primary platforms impacted include:

• Ollama: A popular framework for running large language models locally.
• LiteLLM: A utility designed to translate API requests across various LLM providers.
• Gotenberg: A developer tool for converting diverse document formats via Docker.
• Gitea: A lightweight self-hosted Git service frequently used in private development environments.

According to Lumen Technologies, over 3,400 servers running these services have been compromised, turning high-performance computational nodes into an unwitting distributed proxy network.

Official Responses and Expert Analysis

The cybersecurity community has responded to the PoeLLM disclosure with a mix of admiration for the threat actor’s creative engineering and serious concern over the security posture of open-source AI infrastructure.

Ryan English, an information security engineer at Black Lotus Labs, emphasized the unprecedented nature of the evasion technique during his briefing with CyberScoop:

"The most interesting piece of the poem approach is that the IP address used for C2 communications is invisible outside of the victim’s netflow. In other malware samples, there might be a hard-coded fallback C2 address, or URL which points to an IP address written elsewhere on the internet. To anyone who comes across it, this is simply a poem on GitHub. It has no links, no files to download, no encrypted text that could easily be flagged as malicious, even by advanced models. There would be no reason for any security researcher to identify this poem as malicious — or know about the IP address hidden within it — unless they had access to the malware referencing it."

Furthermore, English highlighted how the botnet leverages its sheer scale to ensure high availability and resistance to takedowns:

"If one exploit server gets reported by the security community, the attacker can easily pivot and start proxying attacks through hundreds of other compromised victims. Through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more."

Open-source maintainers and platform developers whose software has been weaponized in the campaign have begun issuing urgent advisories, urging system administrators to secure exposed API endpoints, implement robust authentication layers, and monitor outbound network traffic for anomalous connections to public code-sharing platforms like GitHub.

Implications for the Future of Enterprise and AI Security

The emergence of the PoeLLM botnet marks a concerning milestone in the evolution of cyberthreats, carrying profound implications for both enterprise IT security and the rapidly growing artificial intelligence sector.

1. The Weaponization of AI Infrastructure

As organizations rush to integrate artificial intelligence models and microservices into their workflows, they frequently deploy tools like Ollama and LiteLLM without hardening default configurations. These services often run with elevated privileges and high computational capacities, making them lucrative targets for cybercriminals. PoeLLM demonstrates that botnet operators are actively pivoting away from generic consumer hardware toward high-performance servers housing valuable AI frameworks.

2. The Limits of Signature-Based Detection

Traditional security solutions rely heavily on static indicators of compromise (IoCs), such as known malicious IP addresses, domain names, and file hashes. PoeLLM bypasses these defenses entirely by utilizing benign hosting platforms (GitHub) and abstracting infrastructure mapping into natural language. This campaign proves that advanced threat actors can successfully operationalize "living off the trusted cloud" techniques combined with semantic obfuscation, forcing security teams to transition toward behavioral analysis and deep network traffic inspection.

3. Geopolitical and Attribution Challenges

While preliminary code comments and infrastructure staging point toward Italian-speaking threat actors, the true identity, scale, and ultimate motivations of the group remain shrouded in mystery. Investigators have not yet established links between PoeLLM and known Advanced Persistent Threat (APT) groups or financially motivated ransomware syndicates. Whether this campaign is the work of a sophisticated independent cell, an initial-access broker leasing proxy networks to other criminal groups, or a novel state-sponsored intelligence-gathering operation remains an open question.

Recommendations for Defenders

To mitigate the risks posed by PoeLLM and similar novel botnet campaigns, cybersecurity authorities recommend the following hardening steps:

• Secure AI Endpoints: Ensure that open-source AI services (Ollama, LiteLLM, etc.) are never exposed directly to the public internet without authentication, VPN tunnels, or zero-trust access controls.
• Monitor Outbound Traffic: Implement strict egress filtering and NetFlow analysis to detect anomalous or recurring HTTP/HTTPS requests from internal servers to public code repositories or untrusted external IPs.
• Patch Management: Swiftly apply patches for critical infrastructure vulnerabilities, such as the Ivanti Sentry flaws exploited during the initial infection vectors.
• Behavioral Auditing: Regularly audit running container environments and server processes for unauthorized cryptomining scripts, proxy utilities, or unexpected remote code execution attempts.

As cybercriminals continue to innovate, blending artistic deception with technical evasion, the defense community must adapt equally creative and proactive strategies to secure the digital ecosystem.