Loading threat actor…
Prometei is a financially motivated, Russian-speaking cybercriminal botnet and malware operation centered on illicit cryptocurrency mining, primarily Monero, while also providing broad post-compromise access. Public reporting places its activity back to at least 2016, with wider recognition beginning in 2020. It is not assessed as a nation-state actor. Known aliases include Prometei Botnet and Prometei (Russian-linked). Prometei is a modular, multi-stage, cross-platform threat with Windows and Linux/Unix variants. It has been observed exploiting vulnerable internet-facing services for initial access, including Microsoft Exchange vulnerabilities such as CVE-2021-27065 and CVE-2021-26858, and using brute-force attacks against MS SQL services. Its propagation and expansion mechanisms include credential theft, brute-force reuse of harvested credentials, SMB and RDP exploitation including EternalBlue and BlueKeep, SQL and PostgreSQL spreading, and SSH-based lateral movement. Reporting also describes privilege escalation via CVE-2016-0099 in some intrusion chains. Beyond mining, Prometei includes backdoor functionality that enables remote command execution, file download, bot updates, system reconnaissance, mining control, and command-and-control reconfiguration. Associated components have been used for credential harvesting, including a customized Mimikatz-derived tool, and for maintaining persistence and exclusive access on compromised systems. Operators have also used defensive countermeasures such as deleting web shells after use, removing competing web shells from compromised Exchange servers, and adding controls intended to exclude rival malware or miners. Victimology is described as opportunistic rather than narrowly targeted. Observed victims span finance, insurance, retail, manufacturing, utilities, travel, and construction, with infections reported in North America, the United Kingdom, other parts of Europe, South America, and East Asia. Multiple assessments note that the operators appear to avoid infecting targets in former Soviet bloc countries. Prometei’s capabilities extend beyond cryptomining and support credential theft, persistence, reconnaissance, lateral movement, data exfiltration potential, and follow-on access monetization, including possible resale of access or deployment of additional malware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
the attackers exploited recently published Microsoft Exchange vulnerabilities (CVE-2021-27065 and CVE-2021-26858) in order to penetrate the network and install malware
the attackers exploited recently published Microsoft Exchange vulnerabilities (CVE-2021-27065 and CVE-2021-26858) in order to penetrate the network and install malware
RdpcIip can’t spread to other machines using the stolen credentials, it uses the EternalBlue exploit and sends a shellcode to install and launch the main bot module Sqhost.exe.
To use the RDP exploit BlueKeep, the malware uses another component, Bklocal2.exe / Bklocal4.exe
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates a modular botnet for cryptocurrency mining, credential theft, and data exfiltration across Windows and Linux systems.
Financially motivated cybercrime botnet conducting opportunistic intrusions, cryptomining, credential harvesting, lateral movement, and backdoor operations across Windows and Linux environments.
Prometei is described as a backdoor-enabled cryptomining operation distributing XMRig, using brute-force attacks against MS SQL servers, executing PowerShell via xp_cmdshell, exploiting CVE-2016-0099 for privilege escalation, and deploying on both Windows and Linux servers.
Mentioned as another cryptocurrency-mining botnet exploiting Exchange vulnerabilities and deploying China Chopper web shells.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.