prometei

Prometei is a financially motivated, Russian-speaking cybercriminal botnet and malware operation centered on illicit cryptocurrency mining, primarily Monero, while also providing broad post-compromise access. Public reporting places its activity back to at least 2016, with wider recognition beginning in 2020. It is not assessed as a nation-state actor. Known aliases include Prometei Botnet and Prometei (Russian-linked). Prometei is a modular, multi-stage, cross-platform threat with Windows and Linux/Unix variants. It has been observed exploiting vulnerable internet-facing services for initial access, including Microsoft Exchange vulnerabilities such as CVE-2021-27065 and CVE-2021-26858, and using brute-force attacks against MS SQL services. Its propagation and expansion mechanisms include credential theft, brute-force reuse of harvested credentials, SMB and RDP exploitation including EternalBlue and BlueKeep, SQL and PostgreSQL spreading, and SSH-based lateral movement. Reporting also describes privilege escalation via CVE-2016-0099 in some intrusion chains. Beyond mining, Prometei includes backdoor functionality that enables remote command execution, file download, bot updates, system reconnaissance, mining control, and command-and-control reconfiguration. Associated components have been used for credential harvesting, including a customized Mimikatz-derived tool, and for maintaining persistence and exclusive access on compromised systems. Operators have also used defensive countermeasures such as deleting web shells after use, removing competing web shells from compromised Exchange servers, and adding controls intended to exclude rival malware or miners. Victimology is described as opportunistic rather than narrowly targeted. Observed victims span finance, insurance, retail, manufacturing, utilities, travel, and construction, with infections reported in North America, the United Kingdom, other parts of Europe, South America, and East Asia. Multiple assessments note that the operators appear to avoid infecting targets in former Soviet bloc countries. Prometei’s capabilities extend beyond cryptomining and support credential theft, persistence, reconnaissance, lateral movement, data exfiltration potential, and follow-on access monetization, including possible resale of access or deployment of additional malware.