Researchers trace cryptomining campaign across more than 3,400 servers

Cryptomining malware has hit more than 3,400 servers in an ongoing campaign, Lumen's Black Lotus Labs reports. The malware, called PoeLLM, exploits publicly exposed services and uses four words in a poem stored on GitHub to encode addresses for servers that direct infected hosts. Its payload includes XMRig and Iron miners, and infected servers become scanners and exploit servers. Targets include LiteLLM, Ollama, Gotenberg and Gitea. Lumen identified a crafted request to LiteLLM as the likely exploitation path but did not detail the methods for the other services. The poem's address encoding has changed 11 times. Three of the campaign's 12 command servers remained active when Lumen published its findings, and new infections continued.