PoeLLM hijacks exposed AI servers for mining and further attacks

First reported by CyberScoop at · Updated · 4 sources

Compromised machines scan for more victims and serve as launchpads for exploits, extending the cryptomining campaign. CyberScoop and The Hacker News report more than 3,400 infected servers, while RuntimeWire cites more than 2,100 and says the campaign attempted a LiteLLM exploit, according to Lumen's Black Lotus Labs.

  • The malware hides infrastructure coordinates in a poem, according to CyberScoop.

Covered by 4 publishers within 1 hour of the first report.

Reporting4

CyberScoop PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem · Matt Kapko
BleepingComputer PoeLLM malware infects exposed AI servers in cryptomining attacks · Bill Toulas
RuntimeWire PoeLLM turns exposed AI and developer servers into miners and attack launchpads · RuntimeWire Staff
The Hacker News PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet · info@thehackernews.com (The Hacker News)