A four-word GitHub poem rerouted 3,400 servers to miners

The poem is an address book in disguise. PoeLLM pulls four words from fixed positions in the text and looks each one up in a dictionary built into the malware. Every word maps to a number, and the four numbers together form the IPv4 address (the numeric internet address) of the current command-and-control server, or C2, the machine that sends orders to the botnet.

That explains the headline figure. The poem itself is longer, with two stanzas, but only four of its words matter. When the operator wants to move to a fresh server, they edit just those words, and every infected server decodes the fresh address by itself.

The poem lives in a file named dash.css inside a copy of the Node.js website’s source code, set up by a GitHub user called “ejejejdfbbebe.” Node.js itself has nothing to do with the attack. The first commit landed on April 13, 2026, and the poem has been changed 11 times since, each time pointing victims to a new C2 server. The researchers say the decoding pattern has stayed the same throughout. Only the key words change.

It is a clever way to hide in plain sight. A block of verse in a web style file looks harmless, and blocking one server does little when the next address is a poem edit away.

Most victims were running vulnerable versions of open-source AI services, chiefly LiteLLM and Ollama. LiteLLM is a gateway that lets a company send its apps’ requests to many AI models through one point. Ollama lets people run open AI models on their own hardware, although it isn’t open to the internet by default.

Hundreds of servers running Gotenberg, a tool that converts files to PDF, and Gitea, a self-hosted home for software code, were also hit. Gotenberg’s own guide warns users not to expose it to the internet. An Ivanti Sentry gateway, a business security appliance, was how the researchers found the campaign in the first place: in early June a compromised unit contacted a suspicious server and then began scanning for other weak devices.

For LiteLLM, the likely way in was CVE-2026-42271, a flaw where two endpoints would run a command sent by anyone, with no check of who was asking. LiteLLM fixed it in April, and the US cybersecurity agency CISA added it to its list of actively exploited bugs in June. From May, the attackers scanned the internet mainly for ports 3000 and 4000, the default doors for Gotenberg and LiteLLM.

Once inside, PoeLLM installs the XMRig and Iron cryptocurrency miners and connects them to Kryptex, a Russian mining service. Contact with a Kryptex endpoint was the main thing the first 900 victims had in common, which points to a money motive.

Servers built for AI are tempting targets because their powerful graphics chips can mine crypto as well as run models. They may also hold valuable data.

The malware doesn’t stop at mining. It brings a remote shell (a way to control the machine from afar), plus scanning and exploit tools, so each victim helps recruit the next. At its peak, nearly 800 infected servers were active in a single day. More recently, groups of bots began hammering SSH ports and login pages, which suggests the operator is testing password-guessing attacks, though that part looks early-stage.

The victims are mostly in the US and Western Europe. Black Lotus Labs believes, with moderate confidence, that the operator speaks Italian, based on Italian-language traces in the malware and linked GitHub pages. That is an assessment, not a confirmed identity.

Ordinary phone and laptop users aren’t the target here. The risk falls on anyone who has set up an AI tool, a PDF converter or a code server on a machine that can be reached from the internet, whether that’s a startup’s cloud account or a hobbyist’s home lab.

The pattern across victims was simple: exposed services, missing patches and no strong access controls. A bill for stolen computing power is the visible damage. The researchers warn that the same open door can also lead to data theft, abuse of paid AI tokens and attackers moving deeper into a network.

It’s also worth clearing up a common mix-up. Despite the poetry, this isn’t a trick for fooling an AI chatbot with clever verse. No AI model reads the poem. The malware simply parses the text after a server has already been broken into.

If you run any of the affected tools, these steps cover the basics:

• Update LiteLLM to the latest release, and apply the fixed Ivanti Sentry versions listed in Ivanti’s advisory.
• Patch Ollama, Gotenberg and Gitea following each vendor’s current guidance.
• Don’t expose AI gateways, model runners, PDF converters or code hosts directly to the internet without a login and access controls. Close ports you don’t need.
• Check outbound traffic logs for connections to mining pools or unfamiliar servers, and compare them against the indicators of compromise Lumen has published on its GitHub page.
• Investigate any scanning activity coming from your own AI servers right away.
• Keep GPU and model-serving machines on a separate part of the network.

Lumen says its network now refuses all connections with the known PoeLLM control servers, and its researchers will keep watching for new activity. When it published its report, three of the 12 known C2 servers were still active and the campaign was still infecting new machines.