Prometei is a modular, cross-platform botnet first documented by Cisco Talos in 2020 that mines Monero and spreads like a worm. It harvests credentials with a modified Mimikatz and reuses them over SMB and RDP, falls back to EternalBlue, and used the Exchange ProxyLogon chain for initial access in 2021. It is financially motivated, assessed as Russian-speaking, and is not ransomware. MITRE ATT&CK tracks it as S0458.

Prometei: The Cryptomining Worm That Steals Its Way Across the Network

Prometei is a modular, cross-platform botnet — primarily Windows, with Linux variants — that combines Monero cryptomining with credential theft and worm-like self-propagation across internal networks. A main module pulls more than 15 executable modules over HTTP from C2. It is financially motivated and opportunistic, spreading by harvesting credentials with a modified Mimikatz and reusing them over SMB and RDP, falling back to EternalBlue when credential reuse fails, and abusing PsExec and WMI for lateral movement. In 2021 it was observed exploiting Microsoft Exchange ProxyLogon flaws for initial access. MITRE ATT&CK tracks it as S0458.

Overview

Prometei was first publicly documented by Cisco Talos in July 2020. It is assessed as a Russian-speaking, financially motivated operation — module names use Russian, and operators reportedly avoid former Soviet-bloc targets. It is not ransomware: its impact is resource hijacking for mining, not data encryption. (It should not be confused with the unrelated espionage group PROMETHIUM / StrongPity.)

2023 wave

Reporting in March 2023 described a version three that had infected more than 10,000 systems worldwide since November 2022, concentrated in Brazil, Indonesia and Turkey, adding anti-forensics and a domain generation algorithm for C2. Treat the count as a vendor figure relayed by press.

Propagation & Modules

Credential harvesting via a modified Mimikatz; the C2 redistributes stolen credentials to modules that test them over SMB and RDP. T1003.001 T1021.002
Exploit fallback: EternalBlue (MS17-010) and, per some reporting, BlueKeep; PsExec, WMI and an SSH-client module for lateral movement. T1210 T1047
Initial access (2021): the Microsoft Exchange ProxyLogon chain (CVE-2021-26858 and CVE-2021-27065). T1190
Mining: an XMRig-based module mines Monero; a C++ branch handles mining and a .NET branch handles credential theft, able to operate independently. T1496

MITRE ATT&CK Mapping (S0458)

Note

Mapped to documented behaviour; Prometei mines rather than encrypting, so it maps to Resource Hijacking, not Data Encrypted for Impact.

Tactic	Technique	Usage
Credential Access	T1003.001 LSASS Memory	Modified Mimikatz
Lateral Movement	T1021.002 SMB / Admin Shares	Credential reuse
Lateral Movement	T1210 Exploitation of Remote Services	EternalBlue
Execution	T1047 Windows Management Instrumentation	Remote execution
Initial Access	T1190 Exploit Public-Facing Application	ProxyLogon (2021)
Impact	T1496 Resource Hijacking	Monero mining

Detection & Mitigation

Patch MS17-010 and disable SMBv1; patch BlueKeep (CVE-2019-0708) and the Exchange ProxyLogon chain.
Enforce strong unique credentials, LAPS and least privilege to break credential-reuse spread; restrict SMB, RDP, PsExec and WMI laterally; enable LSASS protection to blunt Mimikatz.
Monitor for cryptomining CPU patterns and mining-pool traffic, HTTP module downloads and DGA-style lookups.

Stop Worming Cryptominers

Mjolnir Security helps organisations break credential-reuse propagation and detect cryptomining botnets.

Managed Detection & ResponseThreat HuntingVulnerability ManagementIncident ResponseIdentity Hardening

Managed Detection and Response Monitoring for credential dumping, SMB/RDP spread and cryptomining across the estate.
Identity Hardening Review LAPS, least privilege and LSASS protection to break credential-reuse spread.
24/7 Incident Response Containment of worm-like botnet activity. Call +1 833 403 5875.

Written by: Mjolnir Security  |  Published: October 11, 2026