Loading story…
Cybereason reported incident response cases in which the Prometei botnet compromised organizations in North America by exploiting Microsoft Exchange vulnerabilities CVE-2021-27065 and CVE-2021-26858 for initial access. After entry, the operators deployed a modular malware framework that included components such as sqhost.exe, rdpcIip.exe, ExchDefender.exe, Miwalk.exe, Nethelper, Windrlver.exe, and an XMRig-based SearchIndexer.exe, enabling both Monero cryptomining and persistent access.
Research from Cisco Talos and CUJO AI shows Prometei has long operated as a multi-stage, cross-platform botnet with Windows and Linux variants, expanding well beyond mining into credential theft, reconnaissance, lateral movement, and backdoor activity. The malware spreads through stolen credentials, brute force, SMB/RDP, SSH, SQL, and exploits including EternalBlue and BlueKeep; investigators assessed the operators as financially motivated, Russian-speaking cybercriminals whose infrastructure and samples indicate the botnet has been active since at least 2016 and continues to evolve.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Cybereason published a report detailing Prometei infections tied to Exchange exploitation, describing the botnet's modular tooling, credential theft, lateral movement, and cryptomining activity across multiple regions and industries.
CUJO AI published research focused on the Linux variant of Prometei, adding technical detail on the botnet's cross-platform capabilities.
Cisco Talos published research on the Prometei botnet and its Monero-mining operations, documenting the threat as an active malware campaign.
Cybereason assessed from Prometei infrastructure and malware samples that the botnet has existed since at least 2016 and has continued to evolve over time.
Cybereason investigated incident response cases in which Prometei operators compromised organizations in North America by exploiting Microsoft Exchange vulnerabilities CVE-2021-27065 and CVE-2021-26858, deploying a China Chopper webshell and follow-on malware.
Microsoft listed CVE-2021-26858 in its Security Update Guide, establishing public disclosure of one of the Exchange vulnerabilities later cited in Prometei intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourcecujo.com
Open sourceblog.talosintelligence.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A UK construction firm identified a **Prometei** botnet infection on a Windows Server after attackers likely gained initial access by guessing **weak/default RDP credentials**. eSentire’s Threat Response Unit attributed the activity to the Russian-linked Prometei operation (active since 2016), which is commonly associated with **Monero cryptomining** but also supports credential theft and remote control. For persistence, Prometei was observed installing a service named **`UPlugPlay`** and deploying **`sqhost.exe`**, then downloading an encrypted main payload (**`zsvc.exe`**) and collecting host/system details using native Windows tooling while routing C2 traffic through **Tor**. The intrusion also included post-compromise credential access behavior consistent with **Mimikatz** usage (reported as `miWalk`) to harvest passwords across the environment, plus evasion techniques such as checking for `mshlpda32.dll` and performing decoy actions when analysis/sandbox conditions are suspected. Prometei additionally attempted to “lock in” its access by deploying **`netdefender.exe`** to block other unauthorized access attempts, effectively monopolizing the compromised host. eSentire also released analysis tooling intended to help researchers reverse and track the malware, reinforcing the operational takeaway that exposed RDP and poor credential hygiene remain high-probability entry points for commodity-to-advanced botnet operators.
Jun 29, 2026
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026
Attackers exploited the Microsoft Exchange **ProxyLogon** vulnerability to compromise unpatched Exchange servers and install a **Monero** cryptominer. The campaign used already-compromised Exchange servers to host a staged batch downloader, allowing the malware to spread by targeting other vulnerable systems exposed to the internet. The intrusion chain abused `certutil.exe` to decode a base64-encoded payload named `QuickCPU.exe`, then injected the miner into a running system process to reduce detection. Researchers found the payload contained **xmr-stak** components and was configured to connect over **TLS** to a mining pool tied to the wallet label **"DRUGS,"** indicating an opportunistic post-exploitation operation that monetized Exchange access through illicit cryptocurrency mining.
Aug 14, 2026