CTI · reviewed · 2026-10-08
PoeLLM malware infects exposed AI servers in cryptomining attacks
Actors
—
Malware / tools
PoeLLM
Campaigns
—
CVEs
CVE-2026-10520
Victim sectors
technology
Geography
United StatesEurope
MITRE ATT&CK
Indicators
No curated indicators tied to this case.
Detections
Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.
Sigma raw
title: PoeLLM Botnet Masquerading File Named libgcrypt
id: 52459892-ebbd-4864-9f77-b39e4363a939
status: experimental
description: >
Detects creation of an on-disk file named exactly "libgcrypt" outside
standard library paths. This is the file name Black Lotus Labs observed
for the PoeLLM ELF loader: a cryptomining botnet that has compromised
more than 3,400 exposed AI and development servers (LiteLLM, Ollama,
Gotenberg, Gitea, Ivanti Sentry) since April 2026, deriving its C2 IPv4
addresses from four words of a poem hosted on GitHub. Real libgcrypt
installs are versioned shared objects (libgcrypt.so.20) inside library
directories, so an unversioned file with this exact name is anomalous.
references:
- https://www.bleepingcomputer.com/news/security/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacks/
- https://www.theregister.com/security/2026/10/07/poetry-is-the-new-ai-security-threat-as-poellm-malware-infects-3k-servers/5301672
author: Tia N. List
date: 2026/10/08
tags:
- attack.t1496
- attack.t1190
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith: '/libgcrypt'
filter_system_libs:
TargetFilename|startswith:
- '/lib'
- '/usr/lib'
- '/usr/local/lib'
- '/opt/lib'
condition: selection and not filter_system_libs
falsepositives:
- Source builds or packaging steps that drop a non-shared-object file with this exact name outside library directories
- Container or configuration management workflows writing custom files named libgcrypt
level: medium