“Prometei Botnet Caught Squatting on Windows Servers, Abusing RDP Access and Stealthy Persistence Techniques”

CyberDefender 8 mins0

In January 2026, researchers , identified a malicious command targeting a Windows Server belonging to a client in the construction sector. The attack attempted to deploy Prometei, a sophisticated and long-lived botnet, marking yet another evolution in crypto mining and persistence-centric malware operations.

Prometei isn’t a simple cryptominer—it’s a modular, feature-rich bot with capabilities beyond clandestine coin harvesting. It exhibits remote control, credential theft, lateral movement, and resilience mechanisms that allow it to harden compromised environments and resist removal by other adversaries. Evidence suggests that the Prometei botnet has been active since at least 2016, likely originating from Russian-speaking cybercrime actors.

This article walks through the technical anatomy of this intrusion, detailing how the malware established persistence, decrypted and executed its payload, communicated with command-and-control (C2) infrastructure, and expanded its operational footprint within a target system.

1. Initial Access and Command Execution

In the analyzed incident, native forensic data was limited due to the absence of endpoint detection and logging controls. However, analysis of the Prometei modules suggests that attackers likely gained access via brute-force against Remote Desktop Protocol (RDP), exploiting weak or default credentials to obtain shell access.

Once authenticated, an elevated command combined a Windows cmd.exe instruction with a PowerShell script to bootstrap Prometei:

  1. A key file (C:\Windows\mshlpda32.dll) was created containing a few specific bytes—the “XOR key”—which serves as a seed for Prometei’s decryption routines.
  2. PowerShell then downloaded a base64-encoded, XOR-encrypted payload from a remote host.
  3. The downloaded data was decrypted using a rolling XOR decryption algorithm, reconstructed as zsvc.exe on disk, and executed via PowerShell’s Start-Process.

This multi-stage command is designed not only to introduce the malware but also to evade automated analysis environments (sandboxes). If the key file is absent, Prometei deliberately executes decoy actions before exiting, a tactic that frustrates dynamic analysis and delays detection.

2. Rolling XOR Decryption and Payload Unpacking

Prometei’s encrypted payload is not simply base64 decoded—each byte must be iteratively XOR’d with a progressively calculated key. The key’s construction relies on a predictable algorithmic sequence where each byte of ciphertext is decrypted using a rolling key derived from the XOR seed file and a systematic counter.

This design:

  • Complicates signature-based detection,
  • Ensures that payloads remain unintelligible without correct implementation of the algorithm,
  • Hinders analysis by sandbox and generic malware engines.

A typical decryption pseudo-code looks like:

ciphertext = base64.b64decode('<BASE64_RESPONSE>')
plaintext = bytearray(len(ciphertext))
j = 0
for i in range(len(ciphertext)):
    j += 66
    plaintext[i] = ((ciphertext[i] ^ ((i * 3) & 0xFF)) - j) & 0xFF
print(plaintext)

This routine reveals the decrypted executable, which is then written to disk and launched.

3. Installation and Persistence Mechanisms

Once executed, Prometei undertakes several actions to entrench itself:

Persistence as a Windows Service

  • The malware copies itself to a persistent location such as C:\Windows\sqhost.exe.
  • It creates a Windows Service with a benign-sounding name (e.g., “UPlugPlay”) configured to launch at system startup.

Firewall and Defender Exclusions

  • Prometei modifies Windows Firewall to permit traffic to its service executable.
  • It also creates Microsoft Defender exclusions for its modules, obstructing automatic antivirus scans.

Data Collection for C2 Registration

Standard system tools (LOLBins) such as wmic.exe are used to collect system identifiers and telemetry, which are then sent to the C2 controller as part of an encrypted registration sequence.

4. Command-and-Control Communication

Prometei’s C2 protocols are built atop HTTP, with structured query parameters carrying encrypted data:

  • Machine identifiers are exchanged to authenticate the victim host.
  • Telemetry and fingerprinting data are RC4 encrypted and base64 encoded.
  • Certain fields transmit performance statistics like CPU usage to the botnet server.

This design allows the malware to:

  • Reside quietly within the infected machine,
  • Periodically report status and receive commands,
  • Adapt its operation based on server responses.

5. Functional Modules and Capabilities

Beyond installation, Prometei includes additional modules that facilitate:

  • Credential harvesting, enabling lateral movement across the network,
  • Self-defense, where Prometei actively blocks or removes competing threats,
  • Mining operations, typically targeting Monero (XMR) currency via the compromised host’s CPU.

These modules are orchestrated to maintain exclusive control over the infected infrastructure, making remediation especially challenging if detection is delayed.

6. Detection, Artifacts, and Defensive Measures

The analysis provides a range of actionable defenses for defenders facing Prometei or similar threats:

Artifacts and Detection Rules

  • Process tree signatures for command sequences,
  • Network traffic patterns indicating base64/XOR traffic to suspicious hosts,
  • Yara signatures for identifying Prometei binaries.

Environmental Controls

  • Enforce strong RDP authentication and disable weak credentials,
  • Deploy comprehensive Endpoint Detection and Response (EDR) solutions,
  • Block untrusted external communication to known C2 IPs or domains.

Conclusion

The Prometei botnet exemplifies modern malware’s sophistication, combining stealthy deployment, complex encryption, self-protection, and persistent C2 interaction. The report underscores how adversaries leverage weak remote access configurations and multi-layered execution chains to compromise enterprise systems. Effective defense requires both proactive detection mechanisms and robust response capabilities that can disrupt the botnet’s lifecycle before it establishes a foothold.

CyberDefender