A Botnet Used Poetry To Mine Crypto From Over 3,000 Servers - Here's How

You can file this next bit of news under a creative but uniquely sophisticated category of software engineering. Black Lotus Labs security researchers have discovered a new botnet, powering a rather insidious malware campaign, called PoeLLM. Like any other malware, the goal is to infect as many systems as possible and take control — this one scoops up infected machines into a botnet to build a remote web of servers. What's different about it, however, is that it utilizes a poem, published on GitHub, to issue and deploy commands. Once infected, the compromised machines use a command-and-control (C2) process to phone home to a server, and the location or key to that server is issued through the poetry.

When the actor in control of the malware changes the words in the poem on GitHub, the infected machines use them to derive the new C2 server address. As for how the botnet and the infected systems are being used, it was mostly to mine and steal cryptocurrency and glean insight from other sensitive data sources.

Per Luman Technologies report, Black Lotus Labs first picked up network communications from a compromised system in June 2026, when it phoned home. The peak of the malware attack occurred later that month, eventually involving nearly 2,200 infected servers, with up to 800 active daily. So far, 3,400 servers have been infected, with the common denominator involving systems running vulnerable versions of open-source LLM and AI tools, such as Ollama and LiteLLM. Additional servers were vulnerable and compromised via Gotenberg, an open-source PDF converter.

Machines infected with the malware look up the poem, extract the address, and connect to a remote server for further instructions, becoming AI-powered proxies. Mainly, the instructions were used to infect more machines or mine cryptocurrency. The poem, "On the Nature of Connection," likely AI-generated itself, was disguised inside a nondescript file and hosted on a GitHub repository. Four fixed words peppered into the text served as the key for a remote IPv4 address. Also hardcoded into the malware was a crude cipher, a dictionary that matched words to corresponding numbers.  Together they directed infected machines to a C2 server address.

In one example, the cipher mapped words to numbers as follows: driver to 92, diode to 119, decryption to 164, string to 74. Infected machines converted the words to the numbers, then used those to build the complete C2 server address: 92 dot 119 dot 165 dot 74. The hacker only had to swap out those words for others to change the address, sending compromised systems to a different C2 command server. The poem has been updated at least 11 times since its discovery. Alongside crypto miners, the malware employed a suite of additional tools that empowered infected clients to find and exploit new systems. That's a classic recipe for building a botnet, like the recent Russian example that was linked to more than 10 million devices before it was shut down.

This automated setup allows hackers to focus on multiple vulnerabilities across services, paving the way for a much larger pool of compromised systems. It's also an example of how AI solutions are becoming a huge cybersecurity concern, drastically accelerating both attacks on networks and their defenses. It's mostly supercharging and speeding up attacks, finding vulnerabilities quickly, as we've seen with PoeLLM.

Per Lumen Black Lotus, three of the twelve C2 IP addresses discovered by the team are still active. The team also lists additional infrastructure IPs that may still be compromised and part of the campaign. 

The Lumen article points out that open-source LLM tools like LiteLLM, Ollama, and Gotenberg need more secure APIs, especially with AI tools constantly probing for new attack vectors. Researchers claim open-source LLMs are distinctly vulnerable because they're often hosted on decentralized local or cloud infrastructure that isn't as secure as more locked-down traditional on-premises servers. In addition, open-source tools use external libraries or dependencies, which can be vulnerable, much like the compromised PoeLLM repository. Most of the affected systems were also running software with outdated patch sets, highlighting another important point: keep your tools up to date.

PoeLLM primarily targeted and affected enterprise and commercial servers, but it's still a good lesson for everyone that attackers are using more sophisticated tools and becoming more creative with their approaches every day. Everyone else mounting a defense should have strong monitoring in place to help identify potential vulnerabilities and compromised machines. Lumen Black Lotus recommends consistent network log inspections, with special attention on anomalous behavior, and adherence to network best practices. That includes regular hardware reboots and installing all software updates in a timely manner. At home, something as simple as rebooting your router can help flush potential malware and compromised packages. It's also risky to skip major firmware updates; you could be looking at a compromised network, and that exposes any devices connected to it. Staying on top of modem, router, and device updates is a must.