Botnet targets vulnerable Microsoft Exchange servers

Cryptocurrency-mining botnet Prometei targeting same flaws as Hafnium attacks

Botnet on a red background

Security researchers have revealed that a cryptocurrency-mining botnet, dubbed Prometei, is targeting the same Microsoft Exchange vulnerabilities associated with the recent Hafnium attacks.

According to researchers, these botnets target financial gain by stealing bitcoins and penetrate the network for malware deployment and credential harvesting. With a significant number of organizations far from patched, this puts thousands of businesses worldwide and billions of dollars at risk.

Researchers said that Prometei appears to be active in systems across various industries, including finance, insurance, retail, manufacturing, utilities, travel, and construction. Researchers have also observed the botnet infecting networks in the UK, the US, South America, and East Asia.

Researchers also found hackers were explicitly avoiding infecting targets in former Soviet bloc countries. This leads them to believe the Prometei group is financially motivated and operated by Russian-speaking individuals, though a nation-state does not back it.

The primary function of Prometei is to install the Monero crypto miner on corporate endpoints. The malware is spreading across networks using known Microsoft Exchange vulnerabilities, in addition to known exploits EternalBlue and BlueKeep.

In addition to affecting Windows systems, there are also versions for Linux systems. Researchers said the malware adjusts its payload based on the operating system it detects on the targeted machines when spreading across the network.

Researchers discovered the Prometei botnet in July 2020, but new evidence showed it was in the wild as far back as 2016. The Prometei botnet is continuously evolving, with new features and tools observed in the newer versions, they added.

Assaf Dahan, senior director and head of threat research, Cybereason, said the botnet poses a big risk for companies because it’s been underreported.

“When the attackers take control of infected machines, they are not only capable of mining bitcoin by stealing processing power, but can also exfiltrate sensitive information as well. If they desire to do so, the attackers could also infect the compromised endpoints with other malware and collaborate with ransomware gangs to sell access to the endpoints,” he said.

“And to make matters worse, cryptomining drains valuable network computing power, negatively impacting business operations and the performance and stability of critical servers.”

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Sophos Intercept X Advanced review: AI-powered protection
endpoint security

Sophos Intercept X Advanced review: AI-powered protection

30 Nov 2021
Microsoft hit with formal complaint over "monopolistic" software bundling
collaboration

Microsoft hit with formal complaint over "monopolistic" software bundling

29 Nov 2021
Gmail vs Outlook.com: Which one is better?
email providers

Gmail vs Outlook.com: Which one is better?

26 Nov 2021
Business customers can get 30% off the Surface Laptop Go for Black Friday 2021
Laptops

Business customers can get 30% off the Surface Laptop Go for Black Friday 2021

26 Nov 2021

Most Popular

How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021
What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021