---
title: Hunt: PoeLLM botnet on exposed LiteLLM, Ollama, Gotenberg and Gitea servers (C2 hidden in a GitHub poem; XMRig/Iron miners; beacons on 3778/5001/5002/9999) | ctxsec
url: https://ctxsec.com/items/hunt-poellm-exposed-ai-servers
description: ""
status: "hunt idea (Lumen Black Lotus Labs IOCs)"
published: 2026-10-07
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-poellm-exposed-ai-servers.md)

hunt idea (Lumen Black Lotus Labs IOCs)

2026-10-07

### Hunt: PoeLLM botnet on exposed LiteLLM, Ollama, Gotenberg and Gitea servers (C2 hidden in a GitHub poem; XMRig/Iron miners; beacons on 3778/5001/5002/9999)

Lumen's Black Lotus Labs (Oct 7) tracks PoeLLM, a financially motivated campaign active since April 2026 that it links with moderate confidence to an Italian-speaking actor. The key takeaways put victims at more than 3,400 servers, with peaks above 800 active per day; the body text gives almost 2,200. Most victims are mainly in the US and Western Europe. It exploits exposed services, mostly on ports 4000 (LiteLLM, likely via the /mcp-rest/test/connection endpoint tied to command injection CVE-2026-42271) and 3000 (Gotenberg), plus Ollama, Gitea and possibly Ivanti Sentry (CVE-2026-10520). The malware works out its current C2 IP from four keywords in a poem in a file named dash.css, in a fork of the nodejs.org repo by GitHub user ejejejdfbbebe. The poem has been changed 11 times. C2s are mostly hijacked routers. Hunt for: (1) outbound connections from AI or dev hosts to raw.githubusercontent.com or github.com for that repo, followed by downloads from an IP on port 81 (paths /private/bins.sh, /private/python3.6); (2) beacons to ports 3778, 5001, 5002 or 9999; (3) Kryptex mining traffic (5.180.174[.]162:8029, 46.21.245[.]211:7029 / edge-ru-07[.]kryptex[.]network); (4) known C2 and admin IPs 5.78.73[.]122, 120.224.114[.]212, 191.37.28[.]160, 92.119.165[.]74, 178.128.14[.]204, 185.119.19[.]171 and domain malwarescan[.]xyz; (5) an ELF named libgcrypt outside library paths, sample SHA-256 6fab94577364beec314afae3b082dd680933f08a8349b9f35b92667e8231b501; (6) infected hosts scanning outbound to ports 3000/4000 or SSH. Lumen has a full C2 list on its GitHub.

Sources: [Lumen Black Lotus Labs: Canto incognito (PoeLLM)](https://www.lumen.com/blog/en-us/canto-incognito-tracking-the-poellm-malware) · [Gotenberg install docs (don't expose to internet)](https://gotenberg.dev/docs/getting-started/installation)