PrometheusMalware
Ransomware written in. NET, apparently derived from the codebase of win.hakbit (Thanos) ransomware.From MISP Galaxy
Last reported 3 days ago, by Cisco Talos11 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“Social Engineering Detection Moves Into the Live Conversation”
- T1505.003Web Shell
“The list is uploaded through importing links to web shells.”
- T1552.004Private Keys
“Rather than possessing the mandatory 384 bits of pseudo-random security, several private keys evaluated single-digit and double-digit integers.”
- T1552.008Chat Messages
“…reappears to scan all API endpoints simultaneously: components, nodes, assistants, tools, document-store, vector-store, attachments, chat-messages, lead, apikey, marketplaces, users, and variables.”
- T1553.002Code Signing
“In this incident, six compromised intermediates were for TLS and two were for code signing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
Compromised eMudhra intermediate certificates“To eliminate exploitation across the entire cloud-native ecosystem including Docker, Kubernetes, Terraform, and Prometheus, the Go team designated the compromised certificates as a vulnerability, CVE-2026-111943, and released Go versions 1.27.3 and 1.26.10.”
-
Sekoia Honeypot Captures an Attack on GenAI Infrastructure“Nightingale is a Chinese cloud monitoring and metrics management tool similar to Prometheus/Grafana.”
-
Meshery: Open-source cloud-native manager for Kubernetes“Meshery pulls cluster and application metrics from Prometheus and can import existing Grafana dashboards.”
-
Meta outlines Muse Wonder safeguards for AI agents acting on your behalf“Both models were trained at Meta’s Prometheus data center on long-running tasks to support work on software projects.”
-
High-severity NVIDIA vulnerability lets unauthenticated attackers crash GPU monitoring“…e, utilization, memory usage, power consumption and error events, and publishes it over HTTP, typically on port 9400, for systems like Prometheus to collect.”
-
High-severity Nvidia bug could crash GPU monitoring on exposed servers“In addition to GPU telemetry, Lava looked into Prometheus Node Exporter, which monitors server hardware and operating systems, and also exposes metrics over HTTP.”
-
FBI Arrests ‘Most Wanted’ Developer of Ploutus ATM Malware“On October 2, Anibal Alexander Canelon Aguirre, 50, also known as ‘Prometheus’ and ‘The Engineer’, who was sanctioned last week by the US Treasury, appeared in court to face charges associated with his role in TdA.”
-
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network“Anibal Alexander Canelon Aguirre, known as ‘Prometheus,’ was added in March to the FBI’s Ten Most Wanted Fugitives list, becoming the first person on the list wanted for cybercrimes.”
-
Оновлений інструментарій UAC-0057: OYSTERFRESH, OYSTERSHUCK та OYSTERBLUES“…й із використанням скомпрометованих облікових записів, зокрема із використанням тематики отримання сертифікатів через онлайн-платформу Prometheus.”
-
Switching side jobs“Further analysis showed that the same phishing kit was used during the activity of Prometheus TDS, when an unknown adversary used phishing pages as a final redirect when distributing Hancitor malware.”
-
Prometheus TDS“Prometheus TDS”
Indicators in its reports
named in the reports above- hxxps://designestylelab[.]com/css/in 1 report
- designestylelab[.]comin 1 report
- hxxps://gvenlayer[.]com/track/in 1 report
- gvenlayer[.]comin 1 report
- hxxps://xn--keyvigatrs-key-7oc4531jsva[.]com/ktt/cmd/logonin 1 report
- xn--keyvigatrs-key-7oc4531jsva[.]comin 1 report
- xn--kys-nvigatorky-zp8g5mna[.]comin 1 report
- xn--kynavigatos-ky-pwc6541jna[.]comin 1 report
- navlgator-kcy[.]comin 1 report
- xn--kyavigator-ky-jjc7914ima[.]comin 1 report
- xn--ky-vigatorkey-kjc9383i4ka[.]comin 1 report
- xn--key-vigatrs-key-wuc9688j1wa[.]comin 1 report
- vigatorkey[.]comin 1 report
- rskey[.]comin 1 report
- xn--key-vigatrskey-8oc4531jsva[.]comin 1 report
- hxxp://www.swingsidebilbao[.]com/wp-content/plugins/contact-form-7/includes/block-editor/carl.phpin 1 report
- www.swingsidebilbao[.]comin 1 report
- be3effcb9069ac6d…e33e55980403in 1 report
- hxxps://xn--keynvigatorkey-yp8g[.]com/ktt/cmd/logon0210_4367220121562.docin 1 report
- xn--keynvigatorkey-yp8g[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.