A new version of the Prometei botnet malware has infected over 10,000 systems worldwide since November of 2020. The infections have been reported in Brazil, Indonesia, and Turkey, with a majority of the victims coming from Brazil. Prometei was first observed in 2016 and is known for being a modular botnet that features a large repertoire of components and several proliferation methods. Some of the methods for proliferation include the exploitation of ProxyLogon Microsoft Exchange Server flaws. Another notable feature of Prometei is that it avoids striking Russia, suggesting that the threat actors behind the operation are likely based in the country.
The primary motivation for the cross-platform botnet is financial, leveraging its pool of infected hosts to mine cryptocurrency and harvest credentials. The latest variant of Prometei, called v3, improves upon its existing features to challenge forensic analysis and further burrow its access on victim machines.
The attack sequence proceeds as follows: Once the botnet gains a successful foothold, a PowerShell command is executed to download the botnet payload from a remote server. Prometei's main module is then used to retrieve the actual crypto-mining payload and other auxiliary components on the system. Some of these support modules function as spreader programs designed to propagate the malware through Remote Desktop Protocol (RDP), Secure Shell (SSH), and Server Message Block (SMB).