When the actor in control of the malware changes the words in the poem on GitHub, the infected machines use them to derive the new C2 server address. As for how the botnet and the infected systems are being used, it was mostly to mine and steal cryptocurrency and glean insight from other sensitive data sources. Per Luman Technologies report , Black Lotus Labs first picked up network communications from a compromised system in June 2026, when it phoned home. The peak of the malware attack...
