Prometei botnet improves modules and exhibits new capabilities in recent updates
released on 2023-03-09 @ 06:30:22 PM
Prometei, a highly modular botnet with worm-like capabilities that primarily deploys the Monero cryptocurrency miner, has been continuously improved and updated since it was first seen in 2016, posing a persistent threat to organizations. Talos first analyzed this threat in our 2020 blog post, highlighting its large repertoire of modules, multiple methods of spreading, and continuous development. In our initial analysis and current activity tracking that began in November 2022, we observed Prometei deploying Windows-based tools and malware and other Linux versions observed by security researchers.