PoeLLM Botnet Exploits AI Infrastructure Using GitHub Poem-Based Command Control
Since April 2024, the PoeLLM malware has compromised over 3,400 servers by exploiting AI services and using an innovative command-and-control mechanism hidden within a poem posted on GitHub. The threat actor, believed to be Italian-speaking, uses four specific words from the poem that map to IP addresses through a hard-coded dictionary, allowing dynamic C2 infrastructure changes without updating the malware itself. This botnet primarily focuses on cryptocurrency mining and exploit scanning while creating a network of AI-enabled proxies for potential downstream attacks. The technique demonstrates how threat actors are adapting to exploit the growing AI infrastructure landscape while using creative obfuscation methods to evade detection. The GitHub poem approach represents a new evolution in C2 resilience, as the infrastructure remains invisible to network monitoring tools unless the malware code is directly analyzed, highlighting the increasing sophistication of botnet operators.
Kill Chain
