Poem-Inspired PoeLLM Malware Builds Massive Botnet Targeting Open-Source AI Platforms

Lumen Technologies' Black Lotus Labs disclosed on Wednesday that a newly identified malware family, dubbed PoeLLM, has compromised more than 3,400 servers since April, assembling what analysts describe as a sweeping botnet. The campaign stands out because the malicious code follows a set of technical instructions embedded in a poem authored by the threat actor, a novel twist on conventional malware delivery methods.

The poem, posted on public forums, contains cryptic directives that map to specific configuration steps required to infiltrate servers hosting open‑source artificial‑intelligence frameworks. Researchers say the verses function as a covert playbook, guiding the malware to locate vulnerable AI services, download payloads, and enlist the host into the growing network of compromised machines.

Open‑source AI platforms have seen explosive adoption across startups, research labs, and cloud providers, often running on publicly accessible endpoints to enable rapid model experimentation. This accessibility, combined with the complex dependency chains of machine‑learning libraries, creates a fertile attack surface for adversaries seeking high‑performance compute resources without the overhead of building their own infrastructure.

Security experts warn that the PoeLLM botnet could be leveraged for a range of illicit activities, from cryptocurrency mining that taxes the victim's processing power to coordinated denial‑of‑service attacks that exploit the aggregated bandwidth of thousands of nodes. The scale of the compromise also raises concerns about potential data exfiltration, as many AI services process sensitive datasets during model training and inference.

In response, Black Lotus Labs recommends immediate hardening of AI service deployments: enforce strict authentication, keep libraries up to date, and monitor network traffic for anomalous patterns that match the poem‑derived command sequences. Industry groups are beginning to share indicators of compromise, and several cloud providers have issued advisories urging customers to audit exposed AI endpoints. The investigation remains ongoing, and analysts anticipate that the threat actor may evolve the poetic approach to evade detection in future campaigns.