Security researchers at Black Lotus Labs have identified a novel botnet dubbed PoeLLM that utilizes public GitHub repositories as a dynamic command-and-control mechanism. The malware specifically targets servers running legacy or unpatched open-source artificial intelligence and large language model software to facilitate unauthorized cryptocurrency mining and network propagation.
The operational core of the PoeLLM botnet relies on the manipulation of text-based content hosted on GitHub to dictate the location of its primary control servers. By modifying the specific words within a published poem, the threat actor can effectively update the botnet’s infrastructure without deploying new malicious code to the infected endpoints. This approach allows the attacker to maintain persistence while evading traditional static network detection methods that rely on hardcoded IP addresses or domain names.
Data gathered by the Black Lotus Labs team indicates that the malware has successfully compromised more than 3,400 servers globally. These systems are frequently identified by their reliance on vulnerable deployments of tools such as Ollama and LiteLLM, which often lack the security hardening required for production-facing environments. The attackers exploit these specific software dependencies to gain initial access and establish a foothold within the target network.
Once the malware achieves execution, it initiates a connection to the designated GitHub repository to retrieve the latest configuration data embedded within the poem. This retrieval process enables the botnet to receive updated instructions or migrate its command-and-control operations to entirely new infrastructure at the discretion of the operator. The use of a legitimate, high-reputation platform like GitHub provides a layer of obfuscation that complicates standard traffic analysis and firewall filtering strategies.
The primary objective of the PoeLLM campaign appears to be the deployment of resource-intensive cryptocurrency mining scripts across the compromised server fleet. Beyond financial gain, the botnet functions as a self-propagating tool that actively scans for additional vulnerable instances of AI-related software to expand its reach. This dual-purpose functionality highlights a shift toward leveraging the growing popularity of local LLM deployments as a vector for large-scale infrastructure abuse.
The reliance on open-source AI frameworks creates a unique security challenge for organizations that prioritize rapid development cycles over rigorous patch management. Many of these tools are deployed in containerized environments that may not receive regular security updates, leaving them susceptible to automated exploitation. The PoeLLM botnet demonstrates how attackers are increasingly targeting the specific software supply chains associated with the current boom in machine learning applications.
The technical vulnerability often stems from the default configurations of these AI tools, which may expose administrative interfaces to the public internet without adequate authentication. When developers deploy Ollama or LiteLLM instances to facilitate internal testing, they frequently neglect to implement network-level access controls. This oversight allows automated scanners to identify and compromise the underlying host operating system, providing the attacker with the necessary permissions to install the PoeLLM payload.
Security analysts suggest that the adaptive nature of this command-and-control architecture necessitates a move toward behavioral-based detection rather than simple indicator-of-compromise matching. Organizations should prioritize the isolation of AI-related services behind robust network proxies and implement strict egress filtering to prevent unauthorized connections to public code repositories. Monitoring for unusual outbound traffic patterns from servers hosting LLM environments remains a critical defense against this class of threat.
The ongoing evolution of the PoeLLM campaign underscores the necessity for developers to treat AI-serving infrastructure with the same security scrutiny applied to traditional web servers. Future developments in this area will likely involve more complex encoding techniques within public repositories to further mask the intent of the command-and-control updates. Security teams should prepare for increased activity as the attackers continue to refine their methods for targeting vulnerable AI software stacks.