Threat Research

We recently investigated a cluster of VPSs used for Monero mining, linked to updated samples from past H2miner campaigns. H2miner, active since late 2019, is a crypto-mining botnet, while Lcryx (aka Lcrypt0rx) is a VBScript-based ransomware first seen in November 2024....

Our researchers have observed a new wave of Prometei botnet activity. Prometei refers to both the malware family and the botnet infrastructure used to remotely control compromised Linux and Windows systems for Monero mining and credential theft....