Prometei botnet improves modules and exhibits new capabilities in recent updates
Summary: Cisco Talos reports that the Prometei botnet, first seen in 2016 and now at version 3, has roughly 10,000 infected systems worldwide based on sinkholing its DGA domains for one week in February, with traffic captured from 155 countries. Talos documents new capabilities including a domain generation algorithm producing up to 48 domains per day from the string "xinchao", a self-updating mechanism using the password "horhor123", and deployment of a bundled Apache web server with a PHP-based web shell.
What's compelling: Russia accounts for just 0.31 percent of infections, a distribution Talos reads as targeting influenced by the Russia-Ukraine conflict, while Brazil, Indonesia and Turkey show disproportionately high shares - meaning the operators choose where not to go as deliberately as where they do.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026