The Poetry of Deception: Inside the Sophisticated Botnet Hijacking AI Infrastructure

In a chilling intersection of literature and cyber-espionage, a new, highly resilient strain of malware dubbed “PoeLLM” has successfully compromised more than 3,400 servers globally since April. Unlike traditional malware that relies on static command-and-control (C2) domains or hard-coded IP addresses, this threat utilizes a dynamic, obfuscated infrastructure hidden in plain sight: within the stanzas of a poem hosted on a public GitHub repository.

Discovered by the threat intelligence unit Black Lotus Labs at Lumen Technologies, the campaign represents a significant evolution in how threat actors maintain stealth and longevity. By leveraging a poem as a living, breathing “lookup table,” the attackers have created a system that is virtually invisible to standard network monitoring tools, effectively turning compromised AI-focused services into a private, self-propagating army of malicious proxies.

---

The Mechanism: Decoding the Verse

The genius—and the danger—of PoeLLM lies in its simplicity. To an outside observer, the GitHub repository hosting the poem appears to be a benign collection of creative writing. There are no malicious links, no suspicious file attachments, and no encrypted blobs of data that might trigger an automated heuristic scan.

The malware operates through a process of extraction and transformation. Within the poem’s text, four specific words are selected based on their position relative to fixed text anchors. Once extracted, the malware cross-references these words against a hard-coded dictionary embedded in the binary. Each word in this dictionary corresponds to a specific numerical value. When these four values are concatenated, they form the IP address of the current command-and-control server.

Ryan English, an information security engineer at Black Lotus Labs, notes that the infrastructure is incredibly fluid. "To anyone who comes across it, this is simply a poem on GitHub," English told CyberScoop. "There would be no reason for any security researcher to identify this poem as malicious—or know about the IP address hidden within it—unless they had access to the malware referencing it."

Because the malware simply fetches the poem periodically, the threat actor can rotate their infrastructure at will. By merely changing a few words in the poem, the attacker updates the C2 location across the entire botnet without needing to push a software update or alter the underlying malware code.

---

Chronology of the PoeLLM Campaign

The discovery of PoeLLM did not happen in a vacuum. It was the result of a broader investigation into large-scale scanning operations targeting vulnerable enterprise software.

• April 2024: The campaign begins in earnest, with threat actors targeting open-source AI services and exposed development tools.
• June 2024: Researchers at Black Lotus Labs first encounter the PoeLLM infrastructure while investigating a high-severity vulnerability in Ivanti’s Sentry mobile gateway.
• Summer 2024: The botnet expands rapidly, shifting its focus toward services such as Ollama, LiteLLM, Gotenberg, and Gitea.
• September 2024: Further analysis reveals that the threat actor is not merely scanning for vulnerabilities but is actively deploying the poem-based C2 mechanism to manage their fleet of compromised servers.
• Present Day: The botnet continues to evolve, with researchers noting that the threat actor has demonstrated a high level of operational security, frequently rotating servers to avoid detection by crowd-sourced security intelligence feeds.

---

Supporting Data: An Anatomy of the Threat

The scale of the PoeLLM campaign is indicative of a well-resourced actor, though the total number of individuals behind the operation remains unknown.

The Italian Connection

Evidence gathered from the malware’s source code points to a potential geographic origin. Researchers observed multiple code comments written in Italian, and the infrastructure used for testing the malware’s capabilities was predominantly located within Italy. While this is not definitive proof of nationality, it provides a strong lead for investigators tracking the perpetrators.

The Targeted Ecosystem

The botnet focuses heavily on “AI-adjacent” infrastructure. By compromising services like Ollama (which allows users to run large language models locally) and LiteLLM (a proxy for AI API calls), the attackers are gaining a foothold in the very tools that define the modern AI development stack.

The technical impact of this is twofold:

1. Cryptomining: A significant portion of the compromised power is being diverted to illicit cryptocurrency mining, generating revenue for the attackers.
2. Proxying: The servers act as a distributed network of proxies. When the attacker launches an attack against a high-value target, the traffic appears to originate from thousands of legitimate, compromised AI servers, making it nearly impossible for defenders to block the attack at the perimeter.

---

Implications for Cybersecurity and AI

The emergence of PoeLLM carries severe implications for the security of the AI supply chain. As enterprises scramble to integrate LLMs and AI tools into their workflows, they are often deploying these services on servers that lack the hardened security postures of traditional enterprise infrastructure.

The "Private Army" Effect

English warns that the actor has built more than just a mining botnet. "Through the growth of this botnet, the actor has effectively created a private army of AI-enabled proxies, which will continue to multiply and provide additional vectors for attack, credential theft, token abuse and more."

Because the malware supports remote code execution (RCE), an attacker could theoretically push commands to every compromised server simultaneously. This could lead to:

• Data Exfiltration: Accessing private datasets stored within local AI environments.
• Prompt Injection: Manipulating the AI models on the victim’s server to perform unintended actions.
• Downstream Attacks: Using the compromised servers to perform large-scale credential stuffing or phishing campaigns against other organizations.

The Failure of Traditional Defenses

PoeLLM highlights a growing "visibility gap." Modern security tools are optimized to detect patterns—known malicious domains, known file hashes, or suspicious traffic signatures. By burying their infrastructure in a creative work hosted on a trusted platform like GitHub, the attackers have effectively bypassed these detection layers.

If a security team blocks an IP address used by the botnet, the threat actor simply updates the poem. By the time the security community identifies the new C2 address, the attackers have already pivoted, leaving the defenders in a constant state of reactive, rather than proactive, mitigation.

---

Official Responses and Mitigation Strategies

As of the latest reports, there is no evidence that the threat actor has collaborated with other known state-sponsored or criminal groups. They appear to be operating as a self-contained unit.

Lumen Technologies has recommended that organizations running AI-related services, specifically Ollama, LiteLLM, and Gotenberg, take immediate steps to secure their infrastructure:

1. Restrict Access: Ensure that development tools and AI interfaces are not exposed to the public internet. Use VPNs or zero-trust network access (ZTNA) solutions to control access.
2. Monitor for Anomalies: Look for unusual outbound traffic patterns from AI servers, especially traffic directed at public repositories or unknown IP ranges.
3. Update Software: Patch all vulnerabilities related to Ivanti Sentry and other gateway tools, as these remain the primary entry points for the initial infection.
4. Audit Logs: Review logs for unauthorized execution of code or the presence of unexpected processes, particularly those involving Python or shell scripts that might be attempting to pull external data.

The PoeLLM campaign serves as a sobering reminder that as technology advances, so too does the creativity of the adversary. In the world of cybersecurity, the next great threat may not come from a complex, obfuscated payload, but from something as simple and unassuming as a few lines of verse. Defenders must move beyond static defenses and toward behavioral analysis to stop threats that hide in plain sight.