Black Lotus Labs says PoeLLM has targeted exposed LiteLLM, Ollama, Gotenberg and Gitea since April 2026, with possible Ivanti Sentry targeting.

It reports mining, scanning and exploit delivery from compromised hosts. For defenders, that turns one service incident into a potential launch point for another.

PoeLLM converts four words in an attacker-controlled GitHub poem into a command-and-control address; the report recorded 11 changes after 13 April.

The linked IOC file marked three addresses active on 7 October, a dated status rather than an indefinite one.

Lumen's key takeaways say more than 3,400 victim servers and more than 800 active on a peak day, while two body passages retain almost 2,200. BleepingComputer records a correction from 2,100 to 3,400.

The 3,400 figure is cumulative, not simultaneous, and the source discrepancy remains unresolved. Use the figures to scope the hunt, not to manufacture a precise live total.

One reviewed sample targeted /mcp-rest/test/connection, which Black Lotus Labs calls the likely route and links to CVE-2026-42271. That finding does not establish the route for every victim or any other service.

The report does not establish that PoeLLM used the Starlette bypass. BlackTree's earlier LiteLLM analysis covers that bypass. It remains patching context, not proof the incidents share a campaign.

Lumen did not report observed data theft. That does not make credentials and tokens on a reachable host trustworthy.

BlackTree recommends the following operational checks:

Removing a miner is not enough when the host may also have become an exploitation relay. Recovery should answer how the service was exposed, what executed under…