Malware reads its C2 address out of a poem
PoeLLM reads its command-and-control address out of a poem. The malware, an ELF binary named libgcrypt , pulls four words or phrases from a poem titled "On the Nature of Connection" that lives in a dash.css file inside a GitHub repository posing as a fork of Node.js. A hard-coded dictionary maps each word to a number, and the four numbers assemble into an IPv4 address. To move the C2, the…
The malware known as PoeLLM uses a poem to identify its command-and-control (C2) server address. The rogue ELF binary, named libgcrypt, extracts four words or phrases from a poem called "On the Nature of Connection" stored in a dash.css file within a GitHub repository that pretends to be a fork of Node.js. Each word corresponds to a number in a pre-defined dictionary.
Those four numbers combine to form an IPv4 address. The C2 operator can change the poem to alter the address. The malware campaign, run by Black Lotus Labs, is a cryptocurrency mining operation targeting AI servers. Over 3,400 machines have been compromised, with up to 800 active at one time, serviced by at least 11 C2 servers. The victims are primarily located in the United States and Western Europe and include AI tooling such as LiteLLM, Ollama, the Gotenberg PDF converter, and Gitea.
Additionally, there are indications of Ivanti Sentry targeting. Once PoeLLM infiltrates a system, it drops a remote shell, XMRig and Iron miners, HTTP/S scanning tools, and exploit-deployment code. Infected hosts report to Kryptex, a Russian mining service. The malware scans ports 3000 and 4000, default ports for Gotenberg and LiteLLM, and attempts to exploit CVE-2026-42271, which requires authentication but was discovered in LiteLLM's MCP server test endpoints.
The attack can be further amplified by chaining with CVE-2026-48710, enabling unauthenticated remote code execution. Black Lotus Labs discovered vulnerable router administration interfaces on several C2 servers, suggesting the operator may repurpose compromised routers for infrastructure. Researchers believe with moderate confidence that the operator is Italian, based on comments in the malware and an Italy-based server hosting the administrative interface.
To mitigate the threat, users should patch LiteLLM and other target software, restrict services to trusted IP addresses, and remove services like Gotenberg, LiteLLM, Ollama, Gitea, and Ivanti Sentry from the public internet.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.