logo

PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem

ID: 09ae60f5-4f2e-5f8c-aae6-06422bee7be7

STIX ID: report--09ae60f5-4f2e-5f8c-aae6-06422bee7be7

Feed Name: CyberScoop

Threat Score
78/100

Date Published: 2026-10-07

Date Updated: 2026-10-07

Author: Matt Kapko

...
...

Malware named PoeLLM has compromised thousands of servers by exploiting vulnerabilities in AI-related open-source services and using a novel poem-based mechanism hosted on GitHub to dynamically generate C2 addresses, enabling resilient control, cryptomining, exploit scanning, remote code execution, and proxying attacks through infected hosts.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.