Back Cybersecuritynews

Prometei Botnet Attacking Windows Server to Gain Remote Access and Deploy Malware

Cybersecuritynews •Abinaya • February 11, 2026

A sophisticated attack is targeting Windows Server systems using Prometei, a Russian-linked botnet that has been active since 2016. This multi-functional malware combines cryptocurrency mining, credential theft, and remote-control capabilities to maintain long-term access to compromised systems. The Prometei botnet infiltrates systems by exploiting weak or default credentials via Remote Desktop Protocol (RDP). Once attackers […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Prometei Botnet Targets Windows Servers for Remote Access and Malware Deployment The Prometei botnet, linked to Russian cybercriminals, is actively targeting Windows Server systems to gain remote access and deploy malware. This modular malware is capable of cryptocurrency mining, credential theft, and lateral movement within networks, exploiting weak or default credentials via Remote Desktop Protocol (RDP). Organizations using Windows Server are at risk of long-term compromise due to this sophisticated attack. 4 sources 42

Extracted Entities

Prometei Botnet Attacking Windows Server to Gain Remote Access and Deploy Malware

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)