PoeLLM malware hit thousands of exposed AI servers, including LiteLLM and Ollama: how to check and lock yours down

Update, October 22, 2026: On October 21, 2026, a separate supply-chain attack published a malicious LiteLLM 1.107.0 to PyPI and Docker. See our LiteLLM 1.107.0 guide.

On October 7, 2026, Lumen Technologies' threat research team, Black Lotus Labs, published research on PoeLLM, a malware family that has infected more than 3,400 internet-facing servers since April 2026. Most victims were running self-hosted AI tools, in particular the LiteLLM gateway and Ollama, the popular runner for open models. The botnet mines cryptocurrency on hijacked servers, uses them to attack more targets, and finds its command server in a poem posted on GitHub.

This story is based on Black Lotus Labs' report, the LiteLLM advisory, Ollama and LiteLLM documentation, and security-press coverage, checked October 12, 2026.

The short version

• Scale: more than 3,400 victim servers, peaking at about 800 active in a day, mostly in the US and Western Europe.
• Targets: exposed LiteLLM and Ollama servers, plus Gotenberg and Gitea.
• Trick: the bots decode their command-and-control (C2) IP address from four words in a GitHub-hosted poem.
• Fix: upgrade LiteLLM to 1.83.7 or later, keep Ollama on localhost, and expose neither directly to the internet.

What did Black Lotus Labs find?

According to the report, the operator scans mainly ports 3000 and 4000, the defaults for Gotenberg and the LiteLLM proxy. A vulnerable server receives a crafted request that makes it download a payload from the C2 server. The payload, an ELF binary named libgcrypt, includes a remote shell, the XMRig and Iron cryptominers, an HTTP/HTTPS scanner and exploit code. Each infected server then becomes a scanner and attacker itself.

The miners connect to Kryptex, which Lumen describes as a Russian mining service. Lumen calls the campaign "financially motivated" and assesses that the actor is Italian-speaking. Ryan English of Black Lotus Labs told CyberScoop the actor "has effectively created a private army of AI-enabled proxies." Researchers first spotted the infrastructure in early June 2026 while investigating a compromised Ivanti Sentry host.

How does the GitHub poem hide the C2 server?

The poem, On the Nature of Connection, sits in a file called dash.css in a GitHub fork of the nodejs.org repository (the malware has nothing to do with Node.js). The bot reads four words at fixed positions and maps each to a number using a hard-coded dictionary, producing an IPv4 address. In one earlier version, "driver," "diode," "decryption" and "string" decoded to 92.119.165.74.

To move the botnet, the operator only edits the poem. Lumen counted 11 edits between the first commit on April 13, 2026 and September, each changing only the keywords. Because the lookup is an ordinary request to GitHub, it blends in with normal traffic. English told CyberScoop that many of the C2 servers "were never detected on crowd-sourced security tools."

How were LiteLLM and Ollama servers compromised?

For LiteLLM, Lumen says the endpoint the attacker targets, /mcp-rest/test/connection, "was likely the exploitation path." That endpoint is the subject of CVE-2026-42271. According to the advisory, published April 25, 2026, this endpoint and /mcp-rest/test/tools/list would run an attacker-supplied command on the proxy host. Versions 1.74.2 up to but not including 1.83.7 are affected. The flaw needed a valid proxy API key, but Horizon3.ai showed it could be chained with CVE-2026-48710, a Starlette authentication bypass, for unauthenticated remote code execution. CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalog on June 8, 2026.

For Ollama, the report says victims were running "vulnerable versions" but names no CVE or exploitation path. Ollama's local API has no built-in authentication, so any Ollama server reachable from the internet can already be used by whoever finds it, as our guide to running a model locally with Ollama explains.

How do I check whether my server is exposed?

1. See what's listening. On Linux, ss -tlnp lists listening ports and their bind addresses. 127.0.0.1:11434 means Ollama is local-only. 0.0.0.0:11434 or *:4000 means the service accepts connections on every network interface.
2. Test from outside. From a machine on another network, request http://<your-public-ip>:11434/api/version (Ollama) or port 4000 (LiteLLM). If either answers, it's exposed.
3. Check your LiteLLM version. Run pip show litellm, or check the image tag of your container. Anything from 1.74.2 up to but not including 1.83.7 is vulnerable to CVE-2026-42271.
4. Look for compromise. Compare firewall and netflow logs against the indicators Black Lotus Labs published on GitHub: C2 addresses, the Kryptex pool endpoints, and payload paths on port 81. Sustained, unexplained CPU load suggests a miner. The payload shares its name with the legitimate libgcrypt library, so match by file hash.

How do I lock down Ollama and LiteLLM?

Ollama

• Keep the default bind address. Ollama's FAQ says it "binds 127.0.0.1 port 11434 by default" and that the OLLAMA_HOST environment variable changes it. Don't set OLLAMA_HOST=0.0.0.0 on a machine with a public IP.
• Need remote access? Use an SSH tunnel or a VPN. If you share the server, put it behind a reverse proxy such as Nginx, which the FAQ documents, and add authentication at the proxy, because Ollama has none of its own.
• Firewall port 11434 to trusted hosts only.

LiteLLM

• Upgrade to 1.83.7 or later. The fix limits the MCP test endpoints to users with the PROXY_ADMIN role. Help Net Security's coverage of the advisory also points to Starlette 1.0.1 for the chained bypass.
• If you can't upgrade yet: block the /mcp-rest/test/* endpoints, restrict network access to trusted segments, and rotate the provider keys the proxy stores.
• Follow LiteLLM's security best practices: set a master key (it "must start with sk-") and keep it and provider credentials in a secret store. Run the gateway "on a private network when possible and expose only the routes clients need," use SSO for the Admin UI, turn off the API docs pages in production (NO_DOCS, NO_REDOC, NO_OPENAPI), and patch LiteLLM regularly.

Lumen's general advice: audit your external exposure every time you install a new open-source tool.

Why it matters

Self-hosted gateways and model servers sit next to provider API keys, private data and GPUs. Lumen warns that "exposed AI/LLM services are valuable not only because of software vulnerabilities, but also because they may contain useful data," and that slow patching invites data loss, LLM jacking and lateral movement. As more teams self-host to cut costs (see our comparison of frontier APIs and open models), more of these servers end up online. The rule is the same one we apply to agents: give software only the network reach it needs, as our case against unattended agents argues.

What's confirmed, reported and uncertain

• Confirmed (Black Lotus Labs): the poem-based C2 scheme and its 11 edits, the targeted ports and software, and the payload's capabilities.
• Confirmed (advisory and docs): CVE-2026-42271's affected versions and the 1.83.7 fix, Ollama's default bind address, and LiteLLM's security guidance.
• Conflicting: Lumen's key takeaways say "more than 3,400" victims, but the body of the same report says "almost 2,200." BleepingComputer first reported 2,100, then corrected its story to 3,400.
• Confirmed (CISA): CVE-2026-42271 was added to the Known Exploited Vulnerabilities catalog on June 8, 2026.
• Reported: the CVE-2026-48710 chain (Horizon3.ai, via press).
• Unknown: how Ollama hosts were compromised, which coin is mined, and whether GitHub has acted on the repository.