Resurgence of the Prometei Botnet

Unit 42 researchers describe a March 2025 resurgence of the Prometei botnet’s Linux variants, detailing how the malware is distributed via HTTP, packed with UPX combined with a custom JSON configuration trailer that thwarts standard unpackers, and how it performs system reconnaissance, Monero mining, credential theft, lateral movement, and C2 communications (including a DGA and self-updating capabilities). The report provides static analysis differences between versions, unpacking guidance, a timeline of observed samples, multiple SHA-256 hashes for samples, distribution and C2 URLs, and recommended detections and mitigations.