Prometei & World Leaks: The Evolution of a Botnet from Crypto-Mining to Data Extortion

The cybersecurity landscape is witnessing a strategic pivot from one of the most adaptive botnets in operation: Prometei. Historically recognized as a relentless hunter for Monero (XMR), recent intelligence confirms that Prometei operators are venturing into a darker territory: Data Extortion.

Recent disclosures on World Leaks highlight that this modular botnet is no longer just piggybacking on your server's CPU cycles; it is actively harvesting intellectual property and threatening public exposure.

---

The Evolutionary Threat: Why the Shift?

Prometei is a sophisticated, multi-module botnet utilizing over 15 different components to propagate via SMB exploits (such as EternalBlue), RDP brute-forcing, and SSH vulnerabilities. The success of the "Extortion-only" (non-encrypting) model in the Ransomware-as-a-Service (RaaS) market has clearly influenced its operators.

• Target Profile: Primarily targets Windows and Linux servers with weak administrative controls.

• Deep Camouflage: The malware frequently masquerades as legitimate system services like sqhost.exe or smcard.exe, hiding in non-standard directories (e.g., \Windows\dell\).

• The Extortion Pivot: Rather than the computationally expensive task of encrypting entire drives, they quietly exfiltrate sensitive databases and internal documents before issuing a ransom demand.

Behind the Scenes: Exfiltration Tactics

Newer modules of Prometei show an increased capability to scan for specific document types (.pdf, .docx, .sql) and transmit them to Command & Control (C2) servers via obfuscated protocols. The data leaks appearing on platforms like World Leaks serve as definitive proof: if a system is infected, its data integrity must be considered compromised.

"Prometei is no longer a mere nuisance affecting CPU performance. It is now an existential threat to corporate data confidentiality."

---

Urgent Mitigation Strategies

For security professionals, traditional antivirus solutions are often insufficient. Proactive measures are required:

1. Critical Directory Audits: Regularly inspect for foreign binaries in C:\Windows\dell\ or ProgramData.

2. Defender Exclusion Cleanup: Prometei often whitelists its working directories in Windows Defender. It is vital to selectively remove these exclusions from critical system paths.

3. Protocol Hardening: Disable SMBv1 immediately and ensure all RDP access is gated behind MFA or a VPN.

4. Automated Remediation: Deploy PowerShell-based incident response scripts below capable of atomic quarantine.

---

Conclusion

The appearance of corporate data on World Leaks is a loud wake-up call. Prometei has proven its ability to evolve. The question for IT leaders is no longer "Will we be targeted?" but rather "How quickly can we detect and sever the exfiltration chain?"

---

Source Code:

<#
.SYNOPSIS
    Prometei Malware Remediation and Quarantine Utility.

.DESCRIPTION
    This script is an incident response tool designed to identify and remediate 
    known malicious artifacts associated with Prometei malware based on filename 
    and path patterns. It performs safe quarantine with file-level defanging to 
    neutralize detected artifacts while preserving them for analysis.

.NOTES
    This script has been tested on Windows 11. Compatibility with other Windows 
    versions has not been fully validated.

.AUTHOR
    Fajar Anggiawan
#>

$ErrorActionPreference = "SilentlyContinue"
$ProgressPreference    = "SilentlyContinue"
$script:ActionLog      = New-Object System.Collections.Generic.List[string]

function Write-Log {
    param([string]$Message, [string]$Color = "White")
    $timestamp = Get-Date -Format "HH:mm:ss"
    $fullMsg = "[$timestamp] $Message"
    Write-Host $fullMsg -ForegroundColor $Color
    $script:ActionLog.Add($fullMsg)
}

function Remove-DefenderExclusions {
    try {
        $targetPaths = @($env:SystemRoot, (Join-Path $env:SystemRoot "dell"))
        $currentExclusions = (Get-MpPreference).ExclusionPath

        foreach ($target in $targetPaths) {
            if ($currentExclusions -icontains $target -or $currentExclusions -icontains ($target + "\")) {
                Remove-MpPreference -ExclusionPath $target -ErrorAction SilentlyContinue
                Write-Log "[OK] Defender exclusion removed: $target" -Color Green
            }
        }
    } catch {
        Write-Log "[WARNING] Failed to safely remove Defender exclusions." -Color Red
    }
}

if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "Elevated privileges required. Relaunching..." -ForegroundColor Yellow
    try { Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" } catch {}
    exit
}

$sysRoot       = $env:SystemRoot
$sysDrive      = $env:SystemDrive
$progData      = $env:ProgramData
$appData       = $env:APPDATA
$timestamp     = Get-Date -Format "yyyyMMdd_HHmm"
$quarantineDir = Join-Path $sysDrive "Prometei_Quarantine_$timestamp"

$maliciousFullPaths = @(
    (Join-Path $sysRoot "dell\SearchIndexer.exe"),
    (Join-Path $sysRoot "dell\msdtc.exe")
)

$processesToKill  = @("sqhost", "zsvc", "rdpcIip", "miWalk32", "miWalk64", "bklocal", "smcard", "windrlver")
$servicesToRemove = @("UPlugPlay")

$pathsToRemove = @(
    (Join-Path $sysRoot "sqhost.exe"), (Join-Path $sysRoot "zsvc.exe"),
    (Join-Path $sysRoot "mshlpda32.dll"), (Join-Path $sysRoot "dell"),
    (Join-Path $sysRoot "uplugplay"), (Join-Path $sysRoot "netwalker"),
    (Join-Path $progData "Microsoft\AppServ"), (Join-Path $appData "intel\sqhost.exe")
)

$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

Write-Host "`n=== [ STAGE 1: SCANNING ] ===" -ForegroundColor Cyan
$foundArtifacts = New-Object System.Collections.Generic.List[PSCustomObject]

foreach ($fullPath in $maliciousFullPaths) {
    $proc = Get-Process | Where-Object { $_.Path -ieq $fullPath }
    if ($proc) { $foundArtifacts.Add([pscustomobject]@{ Type = "Process (Malicious)"; Name = $proc.Name; Detail = $fullPath }) }
}

foreach ($procName in $processesToKill) {
    if (Get-Process -Name $procName -ErrorAction SilentlyContinue) {
        $foundArtifacts.Add([pscustomobject]@{ Type = "Process"; Name = $procName; Detail = "Static Match" })
    }
}

foreach ($keyPath in $runKeys) {
    if (Test-Path $keyPath) {
        $match = (Get-Item $keyPath).GetValueNames() | Where-Object { $_ -ieq "UPlugPlay" }
        if ($match) { $foundArtifacts.Add([pscustomobject]@{ Type = "Registry (Run)"; Name = $match; Detail = "Key: $keyPath" }) }
    }
}

foreach ($svc in $servicesToRemove) { if (Get-Service $svc -ErrorAction SilentlyContinue) { $foundArtifacts.Add([pscustomobject]@{ Type = "Service"; Name = $svc; Detail = "" }) } }
foreach ($path in $pathsToRemove) { if (Test-Path $path) { $foundArtifacts.Add([pscustomobject]@{ Type = "File/Path"; Name = $path; Detail = "" }) } }

if ($foundArtifacts.Count -eq 0) {
    Write-Host "Result: System Clean." -ForegroundColor Green
    Read-Host "`nPress ENTER to exit..." ; exit
} else { $foundArtifacts | Format-Table -AutoSize }

$confirm = Read-Host "`nArtifacts detected. Execute Quarantine & Remediation? (Y/N)"
if ($confirm -notin @("Y", "y")) { exit }

Write-Host "`n=== [ STAGE 2: QUARANTINE ] ===" -ForegroundColor Cyan
if (-not (Test-Path $quarantineDir)) { New-Item -Path $quarantineDir -ItemType Directory -Force | Out-Null }

foreach ($path in $pathsToRemove) {
    if (Test-Path $path) {
        try {
            $fileName = Split-Path $path -Leaf
            $destPath = Join-Path $quarantineDir $fileName
            Copy-Item -Path $path -Destination $destPath -Recurse -Force -ErrorAction Stop
            
            if (Test-Path -Path $destPath -PathType Container) {
                Get-ChildItem -Path $destPath -Recurse -File | ForEach-Object {
                    if (-not $_.Name.EndsWith("_")) { Rename-Item -Path $_.FullName -NewName ($_.Name + "_") -Force }
                }
                Write-Log "[BACKUP] Quarantined Folder: $fileName (Contents Defanged)" -Color Yellow
            } else {
                $newFileName = $fileName + "_"
                Rename-Item -Path $destPath -NewName $newFileName -Force
                Write-Log "[BACKUP] Quarantined & Defanged File: $newFileName" -Color Yellow
            }
        } catch { Write-Log "[WARNING] Backup failed for: $path" -Color Red }
    }
}

Write-Host "`n=== [ STAGE 3: REMEDIATION ] ===" -ForegroundColor Cyan

foreach ($fullPath in $maliciousFullPaths) {
    $p = Get-Process | Where-Object { $_.Path -ieq $fullPath }
    if ($p) { $p | Stop-Process -Force ; Write-Log "[OK] Terminated Spoofed Process: $fullPath" -Color Green }
}
foreach ($pName in $processesToKill) { 
    $p = Get-Process -Name $pName -ErrorAction SilentlyContinue
    if ($p) { $p | Stop-Process -Force ; Write-Log "[OK] Terminated: $pName" -Color Green }
}

foreach ($kp in $runKeys) {
    if (Test-Path $kp) {
        $m = (Get-Item $kp).GetValueNames() | Where-Object { $_ -ieq "UPlugPlay" }
        if ($m) { Remove-ItemProperty -Path $kp -Name $m -Force ; Write-Log "[OK] Registry removed: $m" -Color Green }
    }
}
foreach ($svc in $servicesToRemove) { 
    if (Get-Service $svc -ErrorAction SilentlyContinue) {
        Stop-Service $svc -Force ; & sc.exe delete $svc | Out-Null ; Write-Log "[OK] Service deleted: $svc" -Color Green 
    }
}
foreach ($path in $pathsToRemove) { 
    if (Test-Path $path) { 
        try { Remove-Item -LiteralPath $path -Recurse -Force -ErrorAction Stop ; Write-Log "[OK] Deleted: $path" -Color Green } 
        catch { Write-Log "[FAILED] Object locked: $path" -Color Red }
    } 
}

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -Value 0 
netsh advfirewall firewall delete rule name="Secure Socket Tunneling Protocol (HTTP)" | Out-Null
Remove-DefenderExclusions
Write-Log "[OK] Post-remediation hardening complete." -Color Green

$logDir = if ($PSScriptRoot) { $PSScriptRoot } else { [Environment]::GetFolderPath("Desktop") }
$logPath = Join-Path $logDir "$($env:COMPUTERNAME)_$($timestamp).log"

$logContent = @"
==================================================
PROMETEI REMEDIATION AUDIT LOG
==================================================
Host      : $($env:COMPUTERNAME)
Timestamp : $(Get-Date)
Quarantine: $quarantineDir
==================================================
[SCAN SUMMARY]
$($foundArtifacts | Format-Table -AutoSize | Out-String)
[ACTION DETAILS]
$($script:ActionLog -join "`r`n")
==================================================
"@

$logContent | Out-File -FilePath $logPath -Encoding utf8
Write-Host "`nRemediation Complete. Log: $logPath" -ForegroundColor Cyan
Read-Host "`nPress ENTER to exit..."