PoeLLM malware hijacks LiteLLM and Gotenberg servers to mine crypto

The PoeLLM malware campaign is a plain lesson in what happens to self-hosted AI tools that face the open internet. Lumen's Black Lotus Labs published its tracking of PoeLLM, a botnet that breaks into exposed LiteLLM gateways, Gotenberg document servers, and Gitea instances, then puts the hardware to work mining cryptocurrency and attacking the next victim. No zero-day required. Just a port someone forgot to close.

What actually happened

Per Black Lotus Labs, the operator made its first commit on April 13, 2026, ramped up scanning in May, and hit a mid-June peak. The report gives two victim counts, almost 2,200 servers in the body and more than 3,400 in its key takeaways, so treat the scale as "thousands." Lumen assesses with moderate confidence that the actor is Italian-speaking, and most victims are in the U.S. and Western Europe.

The confirmed targets are LiteLLM on port 4000 and Gotenberg, a popular open-source PDF conversion API, on port 3000. For LiteLLM, the likely way in is the MCP test endpoint tied to CVE-2026-42271, the command-injection flaw we covered in July. One crafted POST tells the server to download the payload. Lumen says most victims ran AI tools such as LiteLLM and Ollama.

Once inside, PoeLLM installs XMRig and other miners, opens a remote shell, and turns the host into a scanner that exploits more servers. The clever part is the command channel. The malware reads a poem stored in a forked GitHub repository, pulls four words from fixed positions, and converts them into the IP address of its control server. The poem has changed 11 times since April. The operator moves infrastructure by editing verse, and the malware never needs an update.

Lumen did not confirm that PoeLLM steals LLM API keys. It warns that exposed AI services hold useful data and invite token abuse. A LiteLLM box holds your provider keys, so assume the worst if yours was exposed.

Why it matters for your business

This is the boring failure mode, and it is the one that pays attackers. A developer spins up LiteLLM to route model calls, or Gotenberg to render invoices and packing slips, and the default port ends up public. Six months later it mines Monero on your cloud bill and scans the internet under your IP.

The fix is mostly network work. Neither LiteLLM nor Gotenberg should answer the open internet. Put them on a private network behind your app, patch LiteLLM past the vulnerable versions, and check your logs against the Black Lotus Labs IOC list. If a gateway was exposed, rotate every provider key it held.

Sources: Lumen Black Lotus Labs, Rush Report: LiteLLM CVE-2026-42271.