A botnet named after Prometheus is also exploiting Exchange Server flaws

The botnet was active just days after the Exchange Server vulnerabilities were announced.

Sometimes a glaring new software vulnerability is all that scammers need to revive a trusty hacking scheme. 

Just days after Microsoft announced that suspected Chinese spies were exploiting bugs in Microsoft Exchange Server software in March, Russian-speaking attackers controlling a botnet, or army of compromised computers, used those vulnerabilities to conduct a series of intrusions at companies in North America, according to incident responders at security firm Cybereason.

The hacks, which are among several breaches involving the Exchange Server vulnerabilities, show how the same bugs in widely used software can be used for very different purposes. And the reemergence of the so-called Prometei botnet, named after the Russian word for Prometheus, the Greek god of fire, is a reminder of the many malicious purposes that the zombie computers serve.

Cybereason said it was aware of more than a dozen recent hacking incidents involving the Prometei botnet, which the attackers typically use to generate cryptocurrency. The botnet, first discovered last year, has previously targeted the financial, manufacturing and travel sectors, according to Cybereason.

In this case, the operators of Prometei appear to be solely interested in making money. Botnets, though, are frequently used for multiple purposes, and the Emotet and Trickbot hacking tools are so often used to deploy ransomware that U.S. government agencies and tech companies have tried to disrupt them.

The Prometei administrators have some of the technical groundwork in place should they want to embrace more “destructive payloads,” like ransomware, according to Cybereason. They use EternalBlue, a stolen U.S. National Security Agency hacking tool that allows malicious code to spread from one machine to another. Still, the attackers have confined themselves to using compromised servers to generate the Monero cryptocurrency.  

Ever the opportunists, it’s little surprise that botnet operators were some of the first on the scene when the Exchange Server vulnerabilities were revealed.

“Botnet operators usually want to spread fast and mostly infect machines indiscriminately,” Assaf Dahan, Cybereason’s head of threat research, said in an email.

Dahan and his colleagues make the case that Prometei has been around since 2016, based on a command they found in the malicious code.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure