Cisco Talos discovered a botnet that has been active for several months and infected more than 5,000 computers to secretly mine the confidential Monero cryptocurrency.
In a report, cybersecurity analyst firm Cisco Talos, part of tech giant Cisco Systems, said it had discovered a botnet called Prometei that has been active for several months.
A botnet can disable security controls, copy sensitive files, and disguise itself as other programs to set up hidden mining operations on computer systems. New tools are also constantly emerging on the network to help a botnet avoid detection.
The botnet has infected between 1,000 and 5,000 computer systems since its launch in March, researchers estimate. According to analysts, Prometei has already brought its owner the equivalent of $ 5,000 XMR. Cisco Talos has not identified the hacker, but suggests it is a professional developer based somewhere in Eastern Europe.
Analysts also found that the botnet was stealing credentials such as administrator passwords, possibly for sale on the darknet.
Recall that in May, hackers attacked several supercomputers in Europe to mine Monero. The supercomputer clusters were forced to shut down to investigate incidents.
In addition, in April, the Slovak antivirus company ESET announced that it successfully counteracted a botnet of 35,000 computers in Latin America that mined XMR.
Earlier this year, a division of telecommunications company AT&T Alien Labs analyzed the distribution of malware for hidden mining Monero, which is embedded on mail servers.
