Lumen’s Black Lotus Labs published research on PoeLLM, a malware campaign it has followed since April 2026 that breaks into exposed open-source AI services and puts them to work mining cryptocurrency. Targets include LiteLLM and Ollama servers, along with the PDF tool Gotenberg and the code platform Gitea.
If you run your own AI gateway or local model server to cut subscription costs or keep client data private, this campaign is aimed at setups like yours. A server left open to the internet can burn your electricity or cloud credits for someone else’s profit.
What The PoeLLM Campaign Actually Does
Once inside a server, the malware installs mining software, opens a remote shell, and turns the machine into a scanner that hunts for more victims. Lumen says activity peaked in mid-June with about 2,200 affected servers and nearly 800 active each day, mostly in the United States and Western Europe.
The operators hide their control servers in an unusual place, a poem stored in a GitHub repository. Four keywords in the poem decide where infected machines connect, and the poem has been edited 11 times since April 13, so the destination keeps shifting. Researchers believe the actor is Italian-speaking, though that is an assessment and not a confirmed identity.
Why This Matters For Self-Employed Builders
Solo developers, consultants, and small agencies increasingly self-host tools like LiteLLM to route requests across AI models, or Ollama to run models locally. Those setups often start as weekend experiments and quietly become part of client work, without the hardening a company IT team would apply.
The cost is not only a power bill. A compromised server can expose API keys, client files, and a path into other systems on your network, and a breach tied to your tools can damage trust with the people who pay you.
What Self-Employed Builders Should Do Next
Start with an inventory. List every AI service you run, which ports it uses, and whether it can be reached from the public internet. Lumen’s advice is to keep useful APIs behind a firewall, limit open ports to the minimum, and keep AI tools on a regular patch schedule.
Next, check your logs for connections to the indicators Lumen published on its GitHub page, and rotate any API keys stored on a machine you cannot vouch for. Update and reboot your router as well, since the attackers’ control servers are often compromised routers with weak admin pages.
What To Watch Next
Lumen says it has blocked traffic to and from the control servers it identified, but the poem trick means new ones can appear quickly. Watch for patches to the affected tools and for updated indicator lists from Black Lotus Labs.
This also follows other warnings about automated attacks aimed at small outfits, including our report on AI agents breaking into a company network in under 10 hours. Expect self-hosted AI to stay a favorite target as more solo operators adopt it.
