Lumen's Black Lotus Labs counts more than 3,400 victims, most running exposed LiteLLM or Ollama — internet-facing inference endpoints quietly repurposed to mine cryptocurrency.
The giveaway lived in the verse. Four words inside the poem carried by PoeLLM were swapped out 11 times over the course of the operation, each rewrite pointing the compromised fleet at a fresh set of servers.
That detail comes from Lumen's Black Lotus Labs, whose researchers tie the campaign to a cryptomining strain whose very name nods to the tools it abuses. The poetry was not decoration: per the lab's account, verse served as the vehicle that carried the malware onto more than 3,400 servers.
The victim profile is the sharper story. LiteLLM and Ollama — utilities for routing and serving large models — account for most of the compromised machines, according to Black Lotus Labs. These are the components teams stand up quickly to put a model behind an API, and when they end up reachable from the open internet, they hand strangers a direct line to whatever compute sits behind them.
For anyone buying or operating AI compute, the economics are the point. A cryptomining payload does not steal the model; it quietly repurposes the hardware, converting cycles an organization already pays for into someone else's revenue. A botnet measured in thousands of servers is not an edge case — it is a working demonstration of what default-open deployments cost.
The rotating verse remains the campaign's signature: four words, rewritten 11 times, were enough to keep thousands of hijacked machines pointed at live command servers.
Black Lotus Labs' tally leaves the lesson plain. More than 3,400 servers, most of them running exposed LiteLLM or Ollama instances, were drafted into a mining botnet that announced itself in poem form. For operators of AI serving stacks, the question raised by PoeLLM is no longer whether exposed inference endpoints get discovered, but how much compute they surrender once they are.
萬安算交所 AIXX · 算力硬件实名会员制交易平台 · 进入货源大厅