Prometei botnet and its quest for Monero
Summary: Cisco Talos documented the Prometei botnet, active since March, which spreads over SMB using credentials stolen by a modified Mimikatz module and exploits such as Eternal Blue, then mines Monero. The botnet runs more than 15 modules across two branches, communicates with its C2 over HTTP with RC4-encrypted commands, and was found using two main C2 servers, bk1.bitspiritfun2[.]net and p1.feefreepool[.]net.
What you should know: The spreader flips the WDigest UseLogonCredential registry value to 1 so plaintext credentials sit in memory, then reuses stolen administrator passwords over SMB and RDP to move across the network - meaning one compromised host can hand an attacker the credentials to every system that shares them.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026