PoeLLM: nearly 2,200 AI servers hijacked, and why your Ollama shouldn’t face the internet
On October 7, 2026, Black Lotus Labs, the research team at Lumen Technologies, published its investigation into PoeLLM, malware that has infected nearly 2,200 servers since April. Its favourite targets: exposed AI servers such as Ollama and LiteLLM, open-source tools many businesses install to run their own AI models. The detail that made headlines: the address of the attackers’ command server is hidden in a poem posted on GitHub.
The poem is a curiosity. The real news for a small business is more down to earth: an AI tool installed “just to try it”, then left open to the internet, becomes a target within weeks.
Threat ID card
Black Lotus Labs blocked traffic to the known command servers on its network, but notes the campaign keeps claiming new victims. Its researcher Ryan English, quoted by CyberScoop, sums up the stakes: the attacker has built “a private army of AI-enabled proxies” that opens the door to credential theft and token abuse.
The targeted services, and why
| Service | What it’s for | What the source says |
|---|---|---|
| LiteLLM | Gateway that centralizes access to several AI models (and often the paid API keys) | Port 4000 heavily targeted. The endpoint abused is tied to vulnerability CVE-2026-42271, fixed in version 1.83.7. |
| Ollama | Runs AI models on your own server or workstation | By default, it only listens on the machine itself (127.0.0.1, port 11434). Exposure comes from a configuration change. |
| Gotenberg | Converts documents to PDF, often behind a web application | Port 3000 heavily targeted. Its documentation warns: don’t expose it to the public internet, treat it like a database. |
| Gitea | Hosts your source code in-house, like a small GitHub | Together with Gotenberg, it accounts for hundreds of affected servers, according to Black Lotus Labs. |
Black Lotus Labs also mentions Ivanti Sentry devices and poorly protected routers, reused as relays by the attacker. It’s no accident: AI servers are attractive for their data, for their computing power (graphics cards are ideal for mining) and because these newer tools often fall outside patch management. A gateway like LiteLLM can also hold your OpenAI or other API keys: an attacker who uses them leaves you the bill.
Good, better, best: protecting a self-hosted AI tool
GOOD · THE MINIMUM
- No AI tool port open to the internet.
- Ollama left on 127.0.0.1 unless there’s a specific need.
- Updates applied, starting with LiteLLM 1.83.7 or later.
BETTER · CONTROLLED ACCESS
- Remote access only through a VPN or zero trust network access (ZTNA), with MFA.
- Authentication in front of every web interface.
- API keys with spending limits, rotated after any doubt.
BEST · MONITORING
- An inventory of every installed tool, including trials.
- A check of your external exposure after every new installation.
- Alerts on abnormal CPU or graphics card usage.
These tiers build on Black Lotus Labs’ recommendations (audit external exposure after installing new open-source tools, restrict ports, keep routers and firewalls updated, monitor your attack surface), adapted to the reality of a small business.
Check in 15 minutes
If you or your provider installed an AI tool on a server, workstation or VPS, here are three quick checks.
- On the Linux server, list what’s listening on the targeted ports. An address of
0.0.0.0or*means “open to the whole network”:sudo ss -tlnp '( sport = :3000 or sport = :4000 or sport = :11434 )'
- From outside (a phone off Wi-Fi, for example), try opening
http://your-ip-address:11434or:4000. If a page answers, the whole internet can see it too. - In your logs, search for the IP addresses Black Lotus Labs published on its GitHub page, and watch for an unexplained rise in CPU or graphics card usage, a classic sign of mining.
An exposed server that shows these signs should be treated as compromised: isolate it, rotate every API key it held, and rebuild it cleanly rather than simply updating it.
This campaign echoes two of our recent articles: the Zammad flaw, where a self-hosted help desk was hacked, and FortiBleed, where internet-facing devices remained the target. Websites aren’t spared either: read what the Library and Archives Canada incident means for your website.
How NeoTech can help
For businesses in Laval, Montreal and the North Shore, we inventory what is actually exposed to the internet (servers, VPS, AI tools, routers), close what should be closed and set up secure remote access. Our automated 24/7 monitoring with on-call technician response alerts you when a device behaves abnormally. See also our cybersecurity services.
Book your free cyber check
Not sure what your business exposes to the internet? In a short meeting, we review it with you and tell you what to close first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
- Black Lotus Labs (Lumen) — Canto incognito: tracking the PoeLLM malware (October 2026)
- CyberScoop — PoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem (October 7, 2026)
- GitHub Advisory Database — LiteLLM CVE-2026-42271
- Ollama — FAQ (default bind address)
- Gotenberg — Installation
Photo: Sergei Starostin, Pexels (Pexels licence).