New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide

Mar 10, 2023Ravie LakshmananEndpoint Security / Hacking

An updated version of a botnet malware called
Prometei has infected more than 10,000 systems
worldwide since November 2022.

The infections are both geographically indiscriminate and
opportunistic, with a majority of the victims reported in Brazil,
Indonesia, and Turkey.

Prometei, first observed in 2016, is a modular botnet that
features a large repertoire of components and several proliferation
methods, some of which also include the exploitation^[1]
of ProxyLogon Microsoft Exchange Server flaws.

It’s also notable for avoiding striking Russia, suggesting that
the threat actors behind the operation are likely based in the
country.

The cross-platform botnet’s motivations are financial, primarily
leveraging its pool of infected hosts to mine cryptocurrency and
harvest credentials.

The latest variant of Prometei (called v3) improves upon its
existing features to challenge forensic analysis and further burrow
its access on victim machines, Cisco Talos said^[2]
in a report shared with The Hacker News.

The attack sequence proceeds thus: Upon gaining a successful
foothold, a PowerShell command is executed to download the botnet
payload from a remote server. Prometei’s main module is then used
to retrieve the actual crypto-mining payload and other auxiliary
components on the system.

Some of these support modules function as spreader programs
designed to propagate the malware through Remote Desktop Protocol
(RDP^[3]), Secure Shell (SSH^[4]), and Server Message
Block (SMB^[5]).

Prometei v3 is also noteworthy for using a domain generation
algorithm (DGA^[7]) to build out its
command-and-control (C2) infrastructure. It further packs in a
self-update mechanism and an expanded set of commands to harvest
sensitive data and commandeer the host.

Last but not least, the malware deploys an Apache web server
that’s bundled with a PHP-based web shell, which is capable of
executing Base64-encoded commands and carrying out file
uploads.

“This recent addition of new capabilities [indicates] that the
Prometei operators are continuously updating the botnet and adding
functionality,” Talos researchers Andrew Windsor and Vanja Svajcer
said.