bleeping-computer Oct 7, 2026 · Crawled Oct 7, 2026

PoeLLM malware infects exposed AI servers in cryptomining attacks

3 IoCs 2 CVEs

AI Summary

The PoeLLM malware is a cryptomining campaign targeting exposed AI servers, particularly those running LiteLLM, Ollama, Gotenberg, and Gitea. It uses an ELF file named libgcrypt that retrieves command-and-control (C2) addresses by extracting keywords from a poem hosted on GitHub, which are then mapped to IPv4 addresses via a hardcoded dictionary. The malware enables remote shell access, deploys XMRig and Iron cryptocurrency miners, and turns infected servers into scanners to propagate further, exploiting CVE-2026-42271 and potentially chaining it with CVE-2026-48710 for unauthenticated RCE. Over 3,400 servers have been compromised, primarily in the US and Western Europe, with C2 infrastructure showing signs of Italian origin.

AI-extracted · verify before operational use

Extracted Entities 2 found

CVE CVE-2026-42271 → CVE CVE-2026-48710 →

Indicators of Compromise 3 extracted

Type	Value	Detail
Filename	libgcrypt	Details →
GitHub Repo	dash.css	Details →
Domain	kryptex[.]com	Details →

MITRE ATT&CK TTPs 19 techniques

T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1048 Exfiltration Over Alternative Protocol · Exfiltration T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1203 Exploitation for Client Execution · Execution T1210 Exploitation of Remote Services · Lateral Movement T1211 Exploitation for Defense Evasion · Defense Evasion T1552 Unsecured Credentials · Credential Access T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access