Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers
PoeLLM cryptomining botnet infected 3,400+ servers running exposed LiteLLM, Ollama, and Gotenberg, decoding C2 addresses from a GitHub poem.
65
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenAug 12, 2026
- Last mentioned22d ago
Timeline
3 articles · newest firstGoogle: AI Is Changing the Pace and Profile of Vulnerability Discovery
Google Threat Intelligence reports monthly vulnerability disclosures doubled in 2026, with exploited-in-the-wild counts nearly doubling as AI accelerates discovery.
62
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
Malicious LiteLLM 1.82.7/1.82.8 PyPI releases tied to the Trivy TeamPCP campaign harvested cloud, SSH, and database credentials, potentially exposing 2,500+ organizations.
78
Related CVEs
by mentions- CVE-2026-10520100%10.0Unauthenticated OS Command Injection in Ivanti Sentry
- CVE-2026-173193%9.9Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA
- CVE-2026-3363460%9.4Embedded Malicious Code in Aquasecurity Trivy, trivy-action, and setup-trivy Releases
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
Appears with
- CISAorganization · 1
- X Corpvictim · 1
- Google Threat Intelligence Grouporganization · 1
- PyPAorganization · 1
- Ollamaorganization · 1
- Gotenbergorganization · 1
- Black Lotus Labsorganization · 1
- UNC6780threat actor · 1
- FBIorganization · 1
- BeyondTrustorganization · 1
- FedExvictim · 1
- Aqua Securityvendor · 1
- NVIDIAvictim · 1
- Ivantiorganization · 1
- BerriAIorganization · 1
- Ciscovictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.