PoeLLM malware uses adversarial poetry to hijack AI servers

Lumen’s threat intelligence team, Black Lotus Labs, has identified a malware campaign known as PoeLLM that uses a technique called “adversarial poetry” to control infected systems. The attacker uses a poem posted on GitHub to steer malware; the code extracts specific words from the poem to derive the address of a command-and-control server. This method allows the attacker to bypass security filters, as the poem contains no suspicious links or encrypted text.

Since April, the campaign has infected more than 3,000 servers, primarily located in the United States and Western Europe. The malware targets exposed enterprise AI tools and open-source services, such as LiteLLM, Ollama, Gitea, and Gotenberg, as well as potentially commercial software like Ivanti Sentry.

The primary objective of the attack is to hijack powerful hardware, such as data center GPUs, to mine cryptocurrency. Once a server is compromised, it acts as a recruiter, scanning the internet to infect additional victims and expand the botnet. Researchers noted that the attacker has rewritten the poem 11 times to maintain control when servers are blocked.