Ethical Hacking News Hubb
Advertisement Banner
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact
No Result
View All Result
Wellnessnewshubb
No Result
View All Result
Home Ethical Hackers

New Version of Prometei Botnet Infects Over 10,000 Systems Worldwide

admin by admin
March 10, 2023
in Ethical Hackers


Mar 10, 2023Ravie LakshmananEndpoint Security / Hacking

An updated version of a botnet malware called Prometei has infected more than 10,000 systems worldwide since November 2022.

The infections are both geographically indiscriminate and opportunistic, with a majority of the victims reported in Brazil, Indonesia, and Turkey.

Prometei, first observed in 2016, is a modular botnet that features a large repertoire of components and several proliferation methods, some of which also include the exploitation of ProxyLogon Microsoft Exchange Server flaws.

It’s also notable for avoiding striking Russia, suggesting that the threat actors behind the operation are likely based in the country.

The cross-platform botnet’s motivations are financial, primarily leveraging its pool of infected hosts to mine cryptocurrency and harvest credentials.

The latest variant of Prometei (called v3) improves upon its existing features to challenge forensic analysis and further burrow its access on victim machines, Cisco Talos said in a report shared with The Hacker News.

Prometei Botnet

The attack sequence proceeds thus: Upon gaining a successful foothold, a PowerShell command is executed to download the botnet payload from a remote server. Prometei’s main module is then used to retrieve the actual crypto-mining payload and other auxiliary components on the system.

Some of these support modules function as spreader programs designed to propagate the malware through Remote Desktop Protocol (RDP), Secure Shell (SSH), and Server Message Block (SMB).

WEBINAR

Discover the Hidden Dangers of Third-Party SaaS Apps

Are you aware of the risks associated with third-party app access to your company’s SaaS apps? Join our webinar to learn about the types of permissions being granted and how to minimize risk.

RESERVE YOUR SEAT

Prometei v3 is also noteworthy for using a domain generation algorithm (DGA) to build out its command-and-control (C2) infrastructure. It further packs in a self-update mechanism and an expanded set of commands to harvest sensitive data and commandeer the host.

Last but not least, the malware deploys an Apache web server that’s bundled with a PHP-based web shell, which is capable of executing Base64-encoded commands and carrying out file uploads.

“This recent addition of new capabilities [indicates] that the Prometei operators are continuously updating the botnet and adding functionality,” Talos researchers Andrew Windsor and Vanja Svajcer said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.





Source link

Tags: computer securitycyber attackscyber newscyber security newscyber security news todaycyber security updatescyber updatesdata breachhacker newshacking newshow to hackinformation securitynetwork securityransomware malwaresoftware vulnerabilitythe hacker news
Previous Post

How to watch Gotham Knights season one online from anywhere

Next Post

What is a Network Operations Center (NOC)? A 2023 Guide

Next Post

What is a Network Operations Center (NOC)? A 2023 Guide

Recommended

Hackers Had Access to LastPass’s Development Systems for Four Days

6 months ago

Researchers Detail AppSync Cross-Tenant Vulnerability in Amazon Web Services

4 months ago

© 2022 Ethical Hacking News Hubb All rights reserved.

Use of these names, logos, and brands does not imply endorsement unless specified. By using this site, you agree to the Privacy Policy and Terms & Conditions.

Navigate Site

  • Home
  • News
  • Ethical Hackers
  • Contact

Newsletter Sign Up.

No Result
View All Result
  • Home
  • News
  • Ethical Hackers
  • Contact

© 2022 Ethical Hacking News Hubb All rights reserved.