Malware Botnet Uses GitHub Poem to Direct Traffic
The campaign compromised 3,400 servers by using a periodically updated poem to map command-and-control server IP addresses.
Updated on Oct. 24, 2026 in Cybersecurity
Live Poll
Do you trust that your home network is currently secure against automated malware and cyber threats?
In June 2026, security researchers identified a malware campaign called PoeLLM that utilized a poem on GitHub as a covert command-and-control mechanism. The botnet compromised at least 3,400 servers to facilitate cryptocurrency mining and data theft.
Why it matters
This campaign highlights a creative evolution in obfuscation techniques, as attackers used legitimate hosting platforms to mask malicious server instructions. The reliance on publicly hosted, mutable content to redirect botnet activity complicates traditional IP-based filtering for defenders.
The botnet utilized a hardcoded dictionary cipher to map words from a poem to numerical values, constructing an IPv4 address. Researchers observed 12 unique IP addresses used for command-and-control, with three of those connections still active.
The players
Lumen Black Lotus
A cybersecurity research team specializing in threat intelligence, botnet analysis, and tracking malicious infrastructure.
GitHub
A developer platform and code-hosting service used by the attackers to store the command-and-control poem.
The details
Infected systems running vulnerable versions of Ollama, LiteLLM, and Gotenberg execute a script to pull text from a poem hosted on GitHub. By updating the specific words in the poem, hackers dynamically change the botnet command-and-control server address without altering the malware code itself. The poem, titled On the Nature of Connection, has been updated 11 times throughout the campaign to refresh the destination of infected traffic.
Timeline
Researchers first detected network communications from a compromised system in June 2026.
The malware attack reached its peak activity level in late June 2026.
The Tech Race
This campaign demonstrates a shift toward using legitimate developer platforms to store configuration data, bypassing traditional domain blacklists. It follows a historical pattern established by campaigns like the 2014 Operation Windigo in its use of complex, multi-stage infrastructure to evade detection.
Administrators managing systems running Ollama, LiteLLM, or Gotenberg should audit their environments for unauthorized outbound connections. Patching these services is the primary defense against the vulnerability that allowed the initial system compromise.
The takeaway
The PoeLLM campaign illustrates that threat actors are increasingly weaponizing static hosting sites to manage ephemeral malicious infrastructure. Defenders should monitor for unusual traffic patterns originating from AI-adjacent software deployments to identify similar covert command-and-control channels.
Further reading
For broader trends in infrastructure security, see the latest updates in Cybersecurity.
Source note: This article includes information reported by BGR.
Live Poll
Do you trust that your home network is currently secure against automated malware and cyber threats?
