A new botnet has been discovered that exploits the Microsoft Windows SMB protocol to spread to systems with the ultimate goal of crypto mining . According to Cisco Talos , the new botnet is called Prometei and appeared in March.
The new Prometei botnet is considered quite dangerous, as it uses a variety of techniques to compromise systems and hide its presence from end users. The botnet aims to mine Monero (XMR).
Prometei's infection chain begins by attempting to compromise Windows Server Message Block (SMB) via SMB vulnerabilities, including Eternal Blue.
Mimikatz and brute-force attacks are used to scan, store, and test stolen credentials. The passwords that are discovered are sent to the hackers' command-and-control (C2) server for reuse by "other entities attempting to verify the validity of passwords on other systems using SMB and RDP protocols."
In total, the Prometei botnet has over 15 executable modules controlled by a main module. The botnet is organized into two main branches of operations: one operation is related to crypto mining and the second one is related to theft , SMB abuse and hiding its action.
Helper modules can be used by malware to communicate over TOR or I2P networks, to collect system information, to detect open ports, to spread to SMBs, and to locate cryptocurrency wallets.
Once a system is compromised and added to the infected network, the attacker can execute commands and programs, set RC4 encryption keys, open, download and steal files, do crypto mining, and more.
Based on Talos' analysis of the crypto mining operation, the victims are not too many. The Prometei botnet has only been operating for four months, so the profits are not currently high ($1,250 per month on average).
Requests from Prometei C2 servers were found from countries such as the US, Brazil, Turkey, China and Mexico.
One of the C2 servers was shut down in June, but this does not appear to have had a significant impact on Prometei's operations.
While $1,250 per month isn't a significant amount compared to other cyber businesses , it could be considered a good monthly salary for a developer, Talos says
