The Microsoft Exchange server drama continues. While patches are available and efforts have been taken to mitigate and fix vulnerabilities in Microsoft Exchange servers, a new botnet is on the hunt for unpatched servers. Prometei is a cryptocurrency botnet that’s being used to target organizations around the world. The botnet scans the web for organizations that haven’t applied patches to fix vulnerabilities to work itself into networks.
Cybersecurity researchers at Cybereason detail the malware attack (via ZDNet). One of the key findings of Cybereason is that Prometei exploits the vulnerabilities associated with the HAFNIUM attacks. The botnet uses these vulnerabilities to work itself onto networks, which allows it to harvest information and mine for the Monero cryptocurrency.
Once Prometei works itself way into a network, it can use several techniques to move around, including harvesting login credentials, exploiting RDP vulnerabilities, and using older exploits. These techniques can be used to infect several machines.
The vast majority of organizations have installed patches or mitigated vulnerabilities in Exchange servers associated with the HAFNIUM attacks, but Prometei can find unpatched and vulnerable servers.
Prometei has been utilized to attack victims in several industries in North America, South America, Europe, and East Asia.
Microsoft and other organizations have taken several steps to fix the vulnerabilities used in the attacks on Exchange servers. As previously reported, hackers are racing to take advantage of unpatched servers. It seems that this will continue to be an issue until all servers are patched or fixed.
My thoughts on Mount & Blade II: Bannerlord after 170 hours in sieges
I’ve poured more than 170 hours of my time into Mount & Blade II: Bannerlord, but it still doesn’t feel anywhere close to a complete game. There are some solid foundations but if you’re waiting for a finished experience, you’ll need to continue sitting on the sidelines for now.
