That LiteLLM box someone spun up for a pilot may be mining crypto for a stranger

By George Bailey   Published: 10/08/26   Updated: 10/10/26   5 min read
Cyber News

Somewhere in your cloud account there may be a LiteLLM proxy someone stood up for a pilot in May, or an Ollama box with a GPU that “we’ll lock down later.” Lumen’s Black Lotus Labs says a botnet called PoeLLM has been looking for exactly those machines since April, and it has found more than 3,400 of them.

The AI pilot nobody added to the asset list is now somebody’s crypto miner and somebody’s scanner.

What happened

Black Lotus Labs published its PoeLLM research on October 7, 2026. The malware, an ELF binary named libgcrypt, mostly lands on internet-exposed open-source services: the LiteLLM AI gateway, Ollama, the Gotenberg PDF converter and the Gitea code host. Lumen also saw possible targeting of Ivanti Sentry. That’s how it first ran into the campaign, while investigating Ivanti Sentry bug CVE-2026-10520.

Once on a server, PoeLLM installs XMRig and Iron crypto miners that report to the Kryptex mining pool, opens a remote shell, and turns the machine into a scanner and exploit launcher for the next victim. Its main targets are ports 3000 (Gotenberg) and 4000 (LiteLLM). For LiteLLM, the sample Lumen analyzed hits /mcp-rest/test/connection, the endpoint behind CVE-2026-42271, a command-injection flaw in LiteLLM’s MCP test endpoints. Horizon3 has shown that chaining it with Starlette’s “BadHost” bug (CVE-2026-48710) removes the need for credentials.

The odd detail: infected machines find their command server by reading a poem. The operator keeps a two-stanza poem, “On the Nature of Connection,” in a file called dash.css in a GitHub repo that forks the nodejs.org site. The malware pulls four words from set positions, maps each to a number, and builds an IPv4 address from them. To move the botnet, the operator edits the poem. Lumen counted 11 edits. It assesses with moderate confidence that the operator speaks Italian, and says victims are mostly in the U.S. and Western Europe. Peak activity passed 800 infected servers in a single day.

Why it matters

Mining is the polite outcome. A LiteLLM proxy holds API keys for every model provider it fronts. Gitea holds your source. And a server that can run commands from a crafted request can do a lot more than mine. These boxes often sit outside normal patching because a team spun them up quickly to try something. Gotenberg’s own install guide says not to expose it to the internet, and Lumen found hundreds of exposed Gotenberg servers anyway.

What to do first

Forward this

If your team runs LiteLLM, Ollama, Gotenberg or Gitea anywhere: a botnet has taken over more than 3,400 exposed copies to mine crypto and attack others. Please tell IT where yours run so we can make sure they aren’t open to the internet.

Details

Hunt / verify

PoeLLM botnet (Lumen, Oct 7): 3,400+ exposed LiteLLM / Ollama / Gotenberg / Gitea servers hijacked for crypto mining and scanning. Find anything internet-facing on 3000/4000/11434, update LiteLLM (≥1.83.7, ideally 1.84.0+) and Starlette (≥1.0.1), pull Gotenberg off the internet, rotate keys on anything that was exposed.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].