Skip to main content

New cryptominer botnet spreads payload, less intrusive

posted onJuly 23, 2020
by l33tdawg
SC Magazine
Credit: SC Magazine

It is the first time that anyone’s documented the a multi-modular botnet, according to Talos, which discovered the botnet and dubbed it “Prometei.” The botnet, which has been active since March, spreads a payload to provide financial benefits for the attackers by mining Monero for a single developer – also the actor – most likely in Eastern Europe.

Talos in a new report said defenders are likely to spot the botnet, but the infection likely won’t be obvious to end-users. The discovery resulted from Talos investigating telemetry information it received from Cisco AMP for Endpoints’ install base.

After studying its activities over the past two months, Talos believes the actor has used different methods to spread Prometei through a network to gain credentials and Windows Management Instrumentation (WMI) and Server Message Block (SMB) exploits. The adversary also uses several crafted tools that help the botnet increase the amount of systems participating in its Monero-mining pool.

Source

Tags

Industry News

You May Also Like

Recent News

Friday, November 8th

Friday, November 1st

Tuesday, July 9th

Wednesday, July 3rd

Friday, June 28th

Thursday, June 27th

Thursday, June 13th

Wednesday, June 12th

Tuesday, June 11th

Friday, June 7th