How Is Microsoft Exchange Vulnerability Being Exploited by Prometei Potnet?

Well, the Proxy Logon Microsoft Exchange vulnerability is again in the news. It’s known that attackers always keep trying new ways to exploit the vulnerabilities. This time attackers have been found using Prometei botnet to compromise Proxy Logon Microsoft Exchange vulnerability (CVE-2021-27065 and CVE-2021-26858) in order to penetrate the network and install Monero crypto-mining malware on the targets. Let’s see how Proxy Logon Microsoft Exchange vulnerability is being exploited by the Prometei botnet?

What Do We Know About the Prometei Botnet?

Promote is a crypto miner mostly created by a group of Russian speakers (not backed by the Russian government), which is used for malicious activities. It is a modular multistage cryptocurrency botnet that has been created for both Windows and Linux platforms. The main goal of the Prometei botnet is to mine Monero cryptocurrency. Researchers found that the Prometei botnet has chosen illegal ways to propagate across the network to mine the Monero coins.

Although, Prometei was officially discovered in June 2020. Researchers recently found the existence of the malware back in 2016. Researchers also found that during these few years, the Prometei has seen several advancements. Now the malware is loaded with a lot of sophisticated features like stealthy backdoor, mining Monero coins, and APT-like features.

Researchers also discovered four different command and control servers (C2) which give a boost to the botnet’s infrastructure. This makes the malware more robust against attacks to take the malware down.

What Is Proxy Logon Microsoft Exchange Vulnerability?

To tell about this in short, Recently, a cyberespionage group, HAFNIUM, has compromised several Microsoft’s Exchange servers by exploiting the four vulnerabilities found in Exchange servers. All these four vulnerabilities are collectively called Proxy Logon Microsoft Exchange vulnerability.

CVE-2021-26855: This is a server-side request forgery (SSRF) vulnerability in Exchange, Which allows arbitrary HTTP requests sent and authenticate as a server. 

CVE-2021-26857: This is an insecure deserialization vulnerability In a united messaging service that allows the attacker to run the code on the Exchange Server. This requires administrator privileges or another vulnerability CVE-2021-26858 to exploit.

CVE-2021-26858 & CVE-2021-27065: This is a Post authentication, and arbitrary file writes vulnerabilities allow an attacker to write a script on any location on the exchange server. This vulnerability requires either exploiting the CVE-2021-26855 SSRF vulnerability or compromising a legitimate admin’s credentials.

Who Are the Victims of Prometei Botnet Malware?

There are no specific targets has seen at this point in time. A wide range of industry sectors has reported the infection, which includes Finance, Insurance, Retail, Manufacturing, Utilities, Travel, and Construction globally. Promote has been observed to be active across the US, the UK, and many other European countries, as well as countries in South America and East Asia. It was also observed that the threat actors appear to be avoiding infecting former Soviet bloc countries. The most concerning aspect is that the targets are random. We warn every industry across the globe.

Threat Actors Behind the Prometei Botnet:

At the time of this report, there is no much information about the threat actors. We believed that the authors of the Prometei botnet are financially motivated and operated by Russian-speaking individuals. Researchers are still collecting evidence to find out more about the threat actors of the Prometei botnet.

Prometei Botnet IoCs:

 China Chopper web shell

C2 Servers:

Promote has four C2 servers. Here is one among them.

Files of Prometei Botnet: