A new malicious called Prometei has been determined, that including Exchange servers have ProxyLogon vulnerability to cryptocurrency network. Prometei is a modular malicious code and has different features like credential dumping, usage of the system for cryptocurrency minning, and lateral movement. Prometei has two different versions for both Windows and GNU/Linux.
Prometei exploits the ProxyLogon vulnerabilities (CVE-2021-27065 and CVE-2021-26858) and uploads China Chopper web Shell. After uploading China Chopper, attackers downloads the zsvc.exe on the victim’s machine with PowerShell. After gaining persistence, another malicious file called sqhost.exe is downloade by attacker. With sqhost.exe, attackers can use the victim system for Monero minning with using XMRig open source code. However, Prometei uses Mimikatz for lateral movement.
A more detailed investigation of Prometei can be found on the cybereason blog page. It looks like threat actors still keep using Prometei. To avoid of this risk, exchange vulnerabilities need to be eliminated fastly, and these IoCs can be used to detect and prevent Prometei.
File Hashs – SHA256