#lumen

The command server's address is four words in a poem, and moving the botnet means editing the poem

Lumen's Black Lotus Labs tracked a malware family that does not carry its command-and-control address. It fetches a poem from GitHub, pulls four words out of fixed positions, and looks them up in a dictionary compiled into the binary. The operator has rewritten the poem eleven times since April.