CERT24PoeLLM malware uses a poem to conceal its command-and-control serversLoading data…
CERT24Threat Observatory
Period

PoeLLM malware uses a poem to conceal its command-and-control servers

Since April 2026, PoeLLM malware has targeted exposed artificial intelligence and large language model infrastructure to deploy cryptocurrency miners and expand a botnet. More than 3,400 victim servers have been identified, concentrated in the United States and Western Europe.

← Back to intelligence

PoeLLM malware uses a poem to conceal its command-and-control servers

Since April 2026, PoeLLM malware has targeted exposed artificial intelligence and large language model infrastructure to deploy cryptocurrency miners and expand a botnet. More than 3,400 victim servers have been identified, concentrated in the United States and Western Europe.