--- title: Poetry is the new AI security threat as PoeLLM malware... description: A financially motivated, suspected Italian threat actor has infected more than 3,000 servers since April with malware dubbed PoeLLM, using an AI-written poem... canonical: https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers | daily.dev og:description: A financially motivated, suspected Italian threat actor has infected more than 3,000 servers since April with malware dubbed PoeLLM, using an AI-written poem... og:url: https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl og:image: https://api.daily.dev/og/posts/KEeSCGscL.png og:image:alt: Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers **[The Register](https://daily.dev/sources/theregister)** · 6 min read · 0 upvotes · 0 comments ## Summary A financially motivated, suspected Italian threat actor has infected more than 3,000 servers since April with malware dubbed PoeLLM, using an AI-written poem posted on GitHub to hide command-and-control instructions, a technique researchers call 'adversarial poetry.' The malware scans for and exploits internet-facing instances of LiteLLM, Ollama, Gotenberg, Gitea, and Ivanti Sentry (CVE-2026-10520), deploying XMRig and Iron cryptominers and turning compromised machines into scanners to find more victims. Black Lotus Labs, which named the campaign Canto Incognito, says the malware extracts specific words from the poem's text and converts them via a hard-coded dictionary into an IPv4 address for its C2 server, updating the poem to relocate infrastructure. Unlike the LiteLLM supply chain attack earlier in the year that hit roughly 2,500 victims through a single compromised service, PoeLLM targets multiple vulnerable AI-related services simultaneously, which researchers say is driving its larger and more resilient botnet. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the PoeLLM malware hide its command-and-control server address inside a poem? PoeLLM extracts four specific words or phrases from fixed positions in a poem posted on GitHub, such as text between "In the silent hum of" and a comma, then converts those words into numbers using a hard-coded dictionary in the malware to assemble an IPv4 address. When the attacker edits the poem's wording, infected servers resolve to a new C2 location automatically. _Teams hardening AI infrastructure against novel C2 techniques can follow research breakdowns like this on daily.dev._ ### What AI-related software is PoeLLM malware exploiting to build its cryptojacking botnet? PoeLLM primarily targets internet-facing, vulnerable deployments of LiteLLM and Ollama, along with the Gotenberg PDF converter and Gitea software development platform, plus commercial software like Ivanti Sentry via CVE-2026-10520. It has infected over 3,000 servers since April, peaking at more than 800 new active servers per day, deploying XMRig and Iron cryptominers. _Anyone running self-hosted LLM tooling can track emerging AI infrastructure threats like this on daily.dev._ ### How does the PoeLLM campaign compare in scale to the LiteLLM supply chain attack via Trivy? The LiteLLM supply chain attack, which began with a compromised Trivy build, exposed more than 2,500 companies and 434,000 CI/CD pipelines but focused on a single service. PoeLLM, by contrast, exploits multiple vulnerable AI-related services at once (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry), which researchers say let its botnet grow past 3,000 victims despite individual services being patched. _Developers weighing AI supply chain risk can compare incidents like these on daily.dev before picking tooling._ ## Similar posts on daily.dev - [Hackers can use 9 of the most popular AI tools to assemble massive botnets](https://daily.dev/posts/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets-j8cybjfqg) · Ars Technica · 13 upvotes · 4 comments - [Supply-chain attacks take aim at your AI coding agents](https://daily.dev/posts/supply-chain-attacks-take-aim-at-your-ai-coding-agents-o8vsjrfrt) · CSO Online · 0 upvotes · 0 comments - [LLMjacking evolved: Attackers are using stolen AI compute to build offensive agentic tools](https://daily.dev/posts/llmjacking-evolved-attackers-are-using-stolen-ai-compute-to-build-offensive-agentic-tools-klku1uvkk) · Sysdig Blog · 1 upvotes · 0 comments --- Tags: [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#ollama](https://daily.dev/tags/ollama), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers","url":"https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl"},"datePublished":"2026-10-07T16:06:08.621Z","dateModified":"2026-10-07T16:06:56.056Z","description":"A financially motivated, suspected Italian threat actor has infected more than 3,000 servers since April with malware dubbed PoeLLM, using an AI-written poem...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/94843fb079fb8c1aad68c4446c3654d7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/94843fb079fb8c1aad68c4446c3654d7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-security,prompt-injection,ollama,litellm","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers-keescgscl#faq","mainEntity":[{"@type":"Question","name":"How does the PoeLLM malware hide its command-and-control server address inside a poem?","acceptedAnswer":{"@type":"Answer","text":"PoeLLM extracts four specific words or phrases from fixed positions in a poem posted on GitHub, such as text between \"In the silent hum of\" and a comma, then converts those words into numbers using a hard-coded dictionary in the malware to assemble an IPv4 address. When the attacker edits the poem's wording, infected servers resolve to a new C2 location automatically. Teams hardening AI infrastructure against novel C2 techniques can follow research breakdowns like this on daily.dev."}},{"@type":"Question","name":"What AI-related software is PoeLLM malware exploiting to build its cryptojacking botnet?","acceptedAnswer":{"@type":"Answer","text":"PoeLLM primarily targets internet-facing, vulnerable deployments of LiteLLM and Ollama, along with the Gotenberg PDF converter and Gitea software development platform, plus commercial software like Ivanti Sentry via CVE-2026-10520. It has infected over 3,000 servers since April, peaking at more than 800 new active servers per day, deploying XMRig and Iron cryptominers. Anyone running self-hosted LLM tooling can track emerging AI infrastructure threats like this on daily.dev."}},{"@type":"Question","name":"How does the PoeLLM campaign compare in scale to the LiteLLM supply chain attack via Trivy?","acceptedAnswer":{"@type":"Answer","text":"The LiteLLM supply chain attack, which began with a compromised Trivy build, exposed more than 2,500 companies and 434,000 CI/CD pipelines but focused on a single service. PoeLLM, by contrast, exploits multiple vulnerable AI-related services at once (LiteLLM, Ollama, Gotenberg, Gitea, Ivanti Sentry), which researchers say let its botnet grow past 3,000 victims despite individual services being patched. Developers weighing AI supply chain risk can compare incidents like these on daily.dev before picking tooling."}}]} ```