Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Resurgence of the Prometei Botnet

Summary: Unit 42 researchers identified a new wave of Prometei attacks in March 2025, focused on the Linux variant of a botnet and malware family first seen in July 2020, which remotely controls compromised systems for Monero cryptocurrency mining and credential theft. The latest versions add a backdoor, a domain generation algorithm for command-and-control, self-updating features, and UPX packing not used in version two, and are distributed via an HTTP GET request to a server hosted on Infinys Network (ASN 58397) in Jakarta, Indonesia.

Key Takeaway: Prometei spreads by brute-forcing credentials, exploiting EternalBlue, and abusing SMB flaws to move laterally, so an unpatched internal network is the path in, and its DGA and self-updating design mean blocking a few domains will not stop it.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Endpoint & Network Security
Related