Prometei Botnet Exploits Windows SMB to Mine for Cryptocurrency and Steal Data

Botnets, generally, are used by attackers to perform automated tasks such as attacking other systems or hijacking their resources for malicious purposes. However, some actors have altered its behavior in recent times. The modern version of botnets can steal and validate credentials, posing a greater threat to organizations under attack.

Lately, Cisco Talos spotted a cryptocurrency-mining botnet doing a similar thing.

Researchers found a multi-modular botnet campaign—active since March 2020—using multiple ways to spread the payload dubbed Prometei to provide financial benefits to the attacker by mining the Monero online currency. So far, it only generates $1,250 per month on average.

In the recent past, many malware have been observed exploiting Microsoft Windows SMB protocol to mine cryptocurrency.

While the behavior of botnets is worrying, enterprises need to ensure that none of their credentials are leaked to the command and control server. Thus, it is need of the hour that every system is monitored constantly for even a small crack in common applications. Security experts advise organizations to use intrusion detection/prevention tools to detect the presence of threats in their infrastructure.