Skip to main content

A botnet is using Exchange server vulnerabilities to mine cryptocurrency on infected PCs

Microsoft Server Bath
Microsoft Server Bath (Image credit: Microsoft)

What you need to know

  • Cyber attackers are using a botnet to mine cryptocurrency off of people's PCs.
  • The botnet scans the web for organizations that have not patched vulnerabilities in Microsoft Exchange servers.
  • The botnet can use the processing power of PCs to mine for Monero.

The Microsoft Exchange server drama continues. While patches are available and efforts have been taken to mitigate and fix vulnerabilities in Microsoft Exchange servers, a new botnet is on the hunt for unpatched servers. Prometei is a cryptocurrency botnet that's being used to target organizations around the world. The botnet scans the web for organizations that haven't applied patches to fix vulnerabilities to work itself into networks.

Cybersecurity researchers at Cybereason detail the malware attack (via ZDNet). One of the key findings of Cybereason is that Prometei exploits the vulnerabilities associated with the HAFNIUM attacks. The botnet uses these vulnerabilities to work itself into networks, which allows it to harvest information and mine for the Monero cryptocurrency.

Once Prometei works itself way into a network, it can use several techniques to move around, including harvesting login credentials, exploiting RDP vulnerabilities, and using older exploits. These techniques can be used to infect several machines.

The vast majority of organizations have installed patches or mitigated vulnerabilities in Exchange servers associated with the HAFNIUM attacks, but Prometei can find unpatched and vulnerable servers.

Prometei has been utilized to attack victims in several industries in North America, South America, Europe, and East Asia.

Microsoft and other organizations have taken several steps to fix the vulnerabilities used in the attacks on Exchange servers. As previously reported, hackers are racing to take advantage of unpatched servers. It seems that this will continue to be an issue until all servers are patched or fixed.

Sean Endicott is the news writer for Windows Central. If it runs Windows, is made by Microsoft, or has anything to do with either, he's on it. Sean's been with Windows Central since 2017 and is also our resident app expert. If you have a news tip or an app to review, hit him up at sean.endicott@futurenet.com.

1 Comment
  • Imagine it's 1988 and someone came up with the technology to make baseball cards that at the time are extremely valuable - but it requires gobs of energy and processing power. So someone breaks into Sandia or Fermilabs to hijack their supercomputers to make baseball cards. These bots are like that. This is how stupid and pointless cryptocurrency is.