A Botnet Is Reading Poetry on GitHub to Hide Its Command Server, and 3,400 Self-Hosted AI Boxes Are Listening

Somewhere on GitHub, in a file called dash.css inside a repository that looks like a fork of the Node.js website, there is a short poem titled "On the Nature of Connection." It is about diodes and copper veins. It is mediocre. It is also the address book for a botnet that has quietly taken over more than 3,400 servers since April 2026.

That is the detail that makes the PoeLLM campaign, analyzed this week by Lumen Technologies' Black Lotus Labs, worth more than a security footnote. The malware does not hard-code the address of its command-and-control server. It does not use a domain-generation algorithm. It fetches the poem, pulls four words from fixed positions relative to anchor text, looks each one up in a dictionary baked into the binary, and assembles an IPv4 address out of the four resulting numbers. One version the researchers captured used "driver," "diode," "decryption," and "string," which resolved to 92.119.165.74. When the operator wants to move to fresh infrastructure, they edit four words in a poem. The decoding pattern has not changed once.

A poem as a configuration file

The disguise is what makes the trick work. The verse sits in a stylesheet file inside a repo camouflaged as nodejs.org source material, and Node.js has nothing to do with it. Black Lotus Labs engineer Ryan English told CyberScoop that the file has "no links, no files to download, no encrypted text" for a scanner to flag. Without a copy of the malware and its hard-coded dictionary, the file reads as nothing more than bad verse about diodes and copper veins. It is, in effect, an encrypted configuration file hiding in the most public place imaginable. The poem has been edited 11 times since the first commit on April 13, 2026, according to Help Net Security, and each edit quietly moved the fleet to fresh infrastructure. Think about what that buys the operator. Every infected machine recalculates the address on its own, which means the whole botnet can be rehomed by changing four words in a commit. There is no DNS to sinkhole, no hard-coded IP to block, and no domain algorithm for defenders to reverse.

Why the victims are self-hosted AI servers

The entry points, by contrast, are boring, and that is the point. The sample the researchers dissected goes after a known command-injection flaw in LiteLLM, tracked as CVE-2026-42271, which the US cybersecurity agency CISA had already flagged as actively exploited back in June 2026. The other large group is exposed Ollama instances, alongside hundreds of servers running the Gotenberg document converter and the Gitea code-hosting platform. Black Lotus Labs first stumbled onto the infrastructure while investigating attacks on Ivanti's Sentry gateway.

Self-hosted inference boxes make unusually tempting targets. They are frequently stood up in an afternoon by a single person, left facing the internet, and skipped in the patch cycle that covers the rest of the network. They also tend to have serious hardware behind them, which matters enormously when the payload is a cryptominer. At the mid-June peak, according to the technical summaries of the disclosure, nearly 2,200 servers were affected and close to 800 were active in a single day. Most victims sit in the United States and Western Europe. If you have ever run Ollama on a box with a port forwarded "just until I set up the VPN," this campaign is the bill coming due.

What happens after the break-in

Once inside, PoeLLM runs the XMRig and Iron miners and points them at the Kryptex mining pool. But mining is only the beginning of the box's new career. The malware also ships a remote shell plus HTTP and HTTPS scanning and exploit modules, so every compromised server becomes another attacker hunting for the next victim. Newer traffic the researchers observed toward SSH and login portals looks like distributed brute-forcing, a capability Lumen says is not yet mature but is clearly being developed.

The researchers named the campaign Canto Incognito and attribute it, with moderate confidence, to an Italian-speaking, financially motivated actor. The binary contains Italian comments, and testing plus command infrastructure was hosted in Italy. They have not tied the operation to any known group, and it is still unclear whether the operator has done anything with the access beyond mining coins. That unknown is what worries Lumen most: the remote-execution capability could be turned against the AI models running on the victims, a long-term concern the researchers rank alongside data theft and lateral movement. Lumen says it has blocked traffic to and from the known command servers on its backbone, which handles the known infrastructure. The technique itself survives.

The clever part was never the exploit; it was that nobody thinks to watch a poem.

The defense is unglamorous

There is no new defensive product to buy here, and that is the takeaway the self-hosting community should sit with. The practical advice from the disclosure reads like a homelab checklist: update LiteLLM to a version that fixes CVE-2026-42271, do not leave Ollama listening on a public interface, put authentication in front of any inference API or bind it to localhost and reach it over a VPN or tunnel, and place these tools in the same patch rotation as everything else instead of treating them as side projects. If you run a media stack alongside your AI experiments, the same discipline applies to the whole rack, whether it is a prebuilt homelab box or a DIY NAS running the latest TrueNAS.

Ollama deserves special attention because its default posture is generous. It happily serves an unauthenticated API to anyone who can reach it. Binding it to localhost, running it behind a reverse proxy with auth, or restricting access to a mesh-style private network takes minutes and eliminates the attack surface this campaign relies on. The LiteLLM entry point is even simpler to close: patch. The flaw was known, the exploit was known, and CISA flagged it months before the disclosure.

What this says about the self-hosted AI boom

Step back and the pattern is familiar, which makes it important. Every computing wave eventually grows a criminal economy around its leftovers. Cloud mining abuse followed GPU cloud credits; this is the self-hosted version, except the compute is sitting in closets and spare rooms, paid for by homeowners who will notice only when the electric bill moves. The self-hosted AI boom has crossed the threshold where attackers treat hobbyist infrastructure as an industrial resource worth tooling against.

There is a second-order lesson about where the weak links live. The malware's poetry trick got the headlines, but the campaign's actual fuel was unpatched, unauthenticated software. Attackers did not need to defeat anyone's model weights or break encryption. They needed an internet-facing LiteLLM and a poem. As of this writing, the operator's identity remains unconfirmed and the technique is portable: any botnet author can now borrow it.

For the self-hosting world, the message from the past week is blunt. The era when your homelab was too small for anyone to bother with is over. The GPUs that make local AI possible also make local AI worth stealing. Patch like you are a target, because six months of evidence says you are.