Loading story…
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the Smominru operation, a Monero cryptomining botnet that infected more than 526,000 Windows hosts—likely many of them servers—primarily through the EternalBlue SMB flaw (CVE-2017-0144), with indications of additional use of EsteemAudit (CVE-2017-0176) and attacks via SQL Server. The operators were estimated to have mined about 8,900 Monero, worth roughly $2.8 million to $3.6 million at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining.
Separate research highlighted a Mirai spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Proofpoint reported that it had monitored the Smominru Monero-mining botnet since the end of May 2017. The botnet spread primarily via the EternalBlue SMB exploit and was also assessed to likely use other propagation methods.
After MineXMR took action, the botnet operators registered new domains and switched mining to a new Monero address on the same pool. Proofpoint said the operators appeared to lose control of about one third of the botnet during the transition before recovering to about two thirds of the prior hash rate.
Proofpoint contacted the MineXMR mining pool and requested that the Monero address associated with Smominru be banned. MineXMR acted several days after the operation began, disrupting the botnet's mining activity.
During a sinkholing operation conducted with abuse.ch and the ShadowServer Foundation, Proofpoint found that Smominru included more than 526,000 infected Windows hosts worldwide. The highest observed concentrations were in Russia, India, and Taiwan, and most infected nodes were believed to be Windows servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybereason reported incident response cases in which the **Prometei** botnet compromised organizations in North America by exploiting Microsoft Exchange vulnerabilities `CVE-2021-27065` and `CVE-2021-26858` for initial access. After entry, the operators deployed a modular malware framework that included components such as `sqhost.exe`, `rdpcIip.exe`, `ExchDefender.exe`, `Miwalk.exe`, `Nethelper`, `Windrlver.exe`, and an XMRig-based `SearchIndexer.exe`, enabling both **Monero cryptomining** and persistent access. Research from Cisco Talos and CUJO AI shows Prometei has long operated as a **multi-stage, cross-platform botnet** with Windows and Linux variants, expanding well beyond mining into credential theft, reconnaissance, lateral movement, and backdoor activity. The malware spreads through stolen credentials, brute force, `SMB`/`RDP`, `SSH`, `SQL`, and exploits including **EternalBlue** and **BlueKeep**; investigators assessed the operators as financially motivated, Russian-speaking cybercriminals whose infrastructure and samples indicate the botnet has been active since at least 2016 and continues to evolve.
Aug 15, 2026
Researchers reported that the **WatchBog** cryptomining botnet expanded its tooling beyond Linux-focused exploitation by adding a **BlueKeep** scanning module that probes RDP services on TCP `3389` for potentially vulnerable Windows hosts. The malware, active since at least 2018, primarily targets unpatched Linux systems and spreads through a Cython-compiled ELF implant that pulls command-and-control data from Pastebin, falls back to a hardcoded `.onion` service, and communicates over HTTPS without proper certificate validation. That TLS weakness allowed defenders to intercept tasking and victim telemetry, helping estimate roughly **4,500 infections** tied to observed infrastructure, though the total may be higher. Across observed campaigns, WatchBog and related Linux miner activity exploited widely known flaws in **Jira, Exim, Solr, Jenkins, Nexus Repository Manager 3, Confluence (`CVE-2019-3396`)**, and also abused **CouchDB** and **Redis** through brute-force or remote code execution. Once deployed, the operators installed **XMRig** or **XMR-Stak** Monero miners, established persistence with cron jobs, moved laterally over SSH using available keys and `known_hosts`, and in some cases used rootkits or Glibc-hooking libraries to hide processes, files, network traffic, and resource usage. Researchers said the activity underscores continued criminal exploitation of long-patched enterprise software vulnerabilities to build stealthy, self-propagating cryptomining botnets.
Aug 14, 2026
Mirai-related botnets remained highly active as operators rapidly incorporated newly disclosed remote code execution flaws and weak-credential attacks against internet-facing IoT and network security devices. Palo Alto Networks Unit 42 reported an active campaign exploiting vulnerabilities including `CVE-2021-27561`, `CVE-2021-27562`, `CVE-2021-22502`, and `CVE-2020-26919` across products such as SonicWall SSL-VPN, D-Link DNS-320, Yealink Device Management, Micro Focus Operation Bridge Reporter, Netis routers, and Netgear ProSAFE Plus devices. Fortinet likewise observed roughly 200 attacks per day in a three-week honeypot study, with nearly 4,000 of about 4,700 Telnet attacks tied to Mirai-related malware families and variants quickly adding exploits such as OptiLink GPON RCE, `CVE-2021-1498`, and `CVE-2021-31755`. Successful compromises typically fetched shell scripts that installed multi-architecture Mirai binaries, and in some cases added SSH brute-force and scanning tools, attempted persistence, removed artifacts, and blocked management ports to retain control. Researchers said the broader botnet ecosystem also remained resilient beyond Mirai alone: Fortinet identified active variants including **SORA**, **SYLVEON**, **Hajime**, and **MANGA**, while earlier Netlab 360 analysis showed Hajime continuing to grow through a modular peer-to-peer architecture and propagation via TR-069 flaws and weak Telnet credentials. The combined reporting underscores that unpatched edge devices and default or weak passwords continued to fuel large-scale botnet expansion.
Aug 15, 2026