PoeLLM Botnet Infects 3,400+ Exposed AI Servers Through LiteLLM's MCP Test Endpoints and Reads Its C2 Address From a Poem

Internet-exposed LiteLLM, Ollama, Gotenberg, and Gitea servers in the US and Western Europe, with some Ivanti Sentry targeting

Lumen Black Lotus Labs reported more than 3,400 compromised servers, peaking at about 800 active in a single day, since at least April 2026, with at least 11 C2 servers. The ELF payload ("libgcrypt") derives its C2 IPv4 address from four words in a poem stored as `dash.css` in a GitHub fork of Node.js, edited 11 times so far. It deploys XMRig and Iron miners and a remote shell, and infected hosts scan ports 3000 and 4000 to exploit CVE-2026-42271 in LiteLLM's MCP server test endpoints, which Horizon3.ai found chains with CVE-2026-48710 for unauthenticated RCE. Attribution is moderate confidence to an Italian operator

AI gateways and model servers left reachable from the internet with test and management endpoints exposed, unpatched months after disclosure