Threat Source newsletter for July 30, 2020
Summary: Cisco Talos reported discovering Prometei, a multi-modular botnet that spreads via SMB with stolen credentials, psexec, WMI and SMB exploits, and mines Monero for the attacker while also harvesting administrator passwords sent to its C2 for reuse over SMB and RDP. Cisco also warned that attackers are actively exploiting a high-severity directory traversal vulnerability in the web services interface of Cisco ASA and FTD software, caused by improper input validation for URLs in HTTP requests, allowing an unauthenticated remote attacker to read sensitive files.
Bottom line: Prometei does not just mine cryptocurrency - it recovers administrator passwords and replays them across other systems over SMB and RDP, so one compromised host can hand an attacker the credentials to move through the rest of the environment.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026