Loading story…
A UK construction firm identified a Prometei botnet infection on a Windows Server after attackers likely gained initial access by guessing weak/default RDP credentials. eSentire’s Threat Response Unit attributed the activity to the Russian-linked Prometei operation (active since 2016), which is commonly associated with Monero cryptomining but also supports credential theft and remote control. For persistence, Prometei was observed installing a service named UPlugPlay and deploying sqhost.exe, then downloading an encrypted main payload (zsvc.exe) and collecting host/system details using native Windows tooling while routing C2 traffic through Tor.
The intrusion also included post-compromise credential access behavior consistent with Mimikatz usage (reported as miWalk) to harvest passwords across the environment, plus evasion techniques such as checking for mshlpda32.dll and performing decoy actions when analysis/sandbox conditions are suspected. Prometei additionally attempted to “lock in” its access by deploying netdefender.exe to block other unauthorized access attempts, effectively monopolizing the compromised host. eSentire also released analysis tooling intended to help researchers reverse and track the malware, reinforcing the operational takeaway that exposed RDP and poor credential hygiene remain high-probability entry points for commodity-to-advanced botnet operators.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
By early February 2026, eSentire released technical analysis, YARA rules, and Python utilities to help researchers unpack and detect Prometei, while recommending stronger passwords, MFA, patching, and improved RDP monitoring.
On the compromised host, Prometei gathered system information, used Mimikatz-based tooling to harvest passwords, communicated through TOR, and deployed a module such as netdefender.exe to block other attackers from accessing the system.
After gaining access, the malware established persistence through a Windows service such as UPlugPlay, dropped components including sqhost.exe, and downloaded or decrypted its main payload, identified as zsvc.exe.
In January 2026, a UK construction firm discovered an intrusion on a Windows Server that eSentire assessed likely began through Remote Desktop Protocol access using weak or default credentials.
Prometei has been active since 2016 as a Russian-linked botnet focused on Monero cryptomining, while also supporting credential theft, remote control, and lateral movement capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybereason reported incident response cases in which the **Prometei** botnet compromised organizations in North America by exploiting Microsoft Exchange vulnerabilities `CVE-2021-27065` and `CVE-2021-26858` for initial access. After entry, the operators deployed a modular malware framework that included components such as `sqhost.exe`, `rdpcIip.exe`, `ExchDefender.exe`, `Miwalk.exe`, `Nethelper`, `Windrlver.exe`, and an XMRig-based `SearchIndexer.exe`, enabling both **Monero cryptomining** and persistent access. Research from Cisco Talos and CUJO AI shows Prometei has long operated as a **multi-stage, cross-platform botnet** with Windows and Linux variants, expanding well beyond mining into credential theft, reconnaissance, lateral movement, and backdoor activity. The malware spreads through stolen credentials, brute force, `SMB`/`RDP`, `SSH`, `SQL`, and exploits including **EternalBlue** and **BlueKeep**; investigators assessed the operators as financially motivated, Russian-speaking cybercriminals whose infrastructure and samples indicate the botnet has been active since at least 2016 and continues to evolve.
Aug 15, 2026
Multiple incident reports show attackers repeatedly using exposed or weakly protected **Remote Desktop Protocol (RDP)** as both an entry point and an internal movement channel. In one intrusion, an actor brute-forced a local administrator account over RDP, created additional access, used **Mimikatz** to dump credentials and Kerberos tickets, and moved across systems before deploying an **XMRig**-based Monero miner. Separate reporting on **Conti** and other hands-on-keyboard operations shows similar post-compromise tradecraft, including credential theft, reconnaissance, use of remote management utilities, and abuse of legitimate Windows administration features to avoid dropping obvious backdoors. Ransomware and espionage cases show the same pattern extending to interactive remote-control tooling beyond standard RDP. ASEC reported **Crysis/Dharma** and **Venus** ransomware actors brute-forcing RDP, stealing credentials, terminating processes, deleting shadow copies, and encrypting systems, sometimes retrying with a second ransomware family after a failed first attempt. North Korea-linked **Kimsuky** has also used **RDP Wrapper**, patched Terminal Services, **VNC**, **Chrome Remote Desktop**, **Ngrok**, and malware such as **AppleSeed**, **Amadey**, and **RftRAT** to maintain GUI-based access, evade user awareness, and support keylogging, file theft, and persistent control of compromised hosts.
Aug 14, 2026
Multiple research reports detailed **Windows-focused malware delivery chains** that rely on social engineering and abuse of legitimate services to blend into normal enterprise traffic. FortiGuard Labs described a **multi-stage campaign targeting users in Russia** that starts with business-themed decoy documents and scripts, then escalates to security-control bypass and surveillance before deploying **Amnesia RAT** and ultimately **ransomware** with widespread file encryption. A notable technique in that intrusion is the abuse of **Defendnot** (a Windows Security Center trust-model research tool) to **disable Microsoft Defender**, while payloads are hosted modularly across public cloud services (e.g., **GitHub** for scripts and **Dropbox** for binaries) to improve resilience and complicate takedowns. Separately, ReliaQuest reported attackers using **LinkedIn private messages** to build trust with targets and deliver a **WinRAR SFX** that triggers **DLL sideloading** via a legitimate PDF reader, then establishes persistence (Registry `Run` key) and executes **Base64-encoded shellcode in-memory** to load a RAT-like payload. Trend Micro and Koi Security documented **Evelyn Stealer**, which weaponizes **malicious VS Code extensions** to drop a downloader DLL (e.g., `Lightshot.dll`), run hidden PowerShell to fetch `runtime.exe`, and inject the stealer into `grpconv.exe`, exfiltrating data (credentials, cookies, wallets, screenshots, Wi‑Fi credentials) to `server09.mentality[.]cloud` over FTP. AhnLab ASEC also reported **proxyjacking** activity in South Korea attributed to **Larva‑25012**, distributing **proxyware disguised as a Notepad++ installer** and evolving evasion (e.g., injecting into Windows Explorer and using Python-based loaders) to monetize victims’ bandwidth via unauthorized proxyware installation.
Jun 29, 2026