Prometei is a Russia-linked botnet that compromises Windows servers, installs a persistent service, steals credentials, mines Monero, and hardens the host to block competing intruders. It uses custom XOR and RC4 encryption, communicates over clear-web HTTP and Tor, and retrieves extra modules via a staged 7-zip archive. The malware leans on legitimate Windows utilities for collection and persistence.
The eSentire Threat Response Unit found the infection on a construction-sector Windows server in January 2026. A malicious command chain created an XOR key file, downloaded a Base64 payload, decrypted it with a rolling XOR routine, and installed the UPlugPlay service. Registry values stored host identifiers and encrypted keys, while outbound HTTP GET traffic carried encrypted system details. Staged downloads also unpacked additional components used for mining.
Enforce strong, unique RDP passwords, enable MFA, disable unnecessary remote services, and apply account lockout policies. Use AppLocker or WDAC to restrict LOLBin abuse and block execution of untrusted tools. Deploy Windows Defender or -gen AV with tailored signatures, and ensure firewall rules can’t be changed to permit unauthorized inbound access.
Isolate the host, terminate UPlugPlay, remove associated files and registry keys, and reset compromised credentials. Scan for other infected systems, block identified C2 IPs/domains, and monitor for repeat process-creation patterns or suspicious firewall rule changes.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: The adversary has gained remote code execution on the victim host and wishes to collect low‑level hardware and OS version details for inventory and future payload tailoring. To stay “living‑off‑the‑land”, the actor uses built‑in Windows utilities that are unlikely to be blocked:
These commands are executed sequentially in a single PowerShell script to mimic a realistic post‑exploitation module. Each command produces a distinct process‑creation event that matches the Sigma rule’s conditions.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
