Home / Technology / Cyber Attack Uses Poems to Hide Server Secrets
Cyber Attack Uses Poems to Hide Server Secrets
8 Oct
Summary
- Malware retrieves C2 server location from poems on GitHub.
- Specific words in poems are decoded into IP addresses.
- Infected devices deploy cryptojackers and scanners for Monero.
Cybersecurity researchers have uncovered a unique cyberattack campaign employing malware that extracts command and control (C2) server locations from poems posted on GitHub. This malware, named PoeLLM, targets vulnerable internet-facing services, such as LiteLLM and Ollama, and then accesses GitHub to find an AI-generated poem titled "On the Nature of Connection."
The PoeLLM malware decodes specific words within the poem, like 'driver' and 'diode,' matching them to hardcoded numbers. These numbers form an IPv4 address, revealing the location of the C2 server. The campaign, attributed to an Italian-based actor, has already updated the poem 11 times since its initial commit, with the latest update occurring in September 2026.
Upon connecting to the C2 server, the malware typically deploys the XMRig cryptocurrency miner, exploiting the infected device's resources for Monero mining. Alternatively, it can function as a scanner, searching for more vulnerable systems to compromise. This adaptable strategy has allowed the campaign to infect over 3,000 devices, making it a significant threat.
