Prowli botnet infects over 40,000 networked devices

Over recent months, Guardicore researchers have identified a cyber crime group they have called “Prowli”, who have been conducting a wide-ranging campaign using an array of techniques to infect more than 40,000 machines at 9,000 companies globally.

They have used various techniques like exploits and password brute-forcing to spread malware and take over devices, such as website content management systems (CMS), web servers, modems, and Internet-of-Things (IoT) devices.

Once a device is compromised, a self-propagating worm is installed to exploit vulnerabilities and expands the botnet by identifying and spreading to new victims. The group have used multiple avenues to generate money from the compromised systems including installing cryptocurrency mining software, as well as redirecting people from legitimate compromised websites to malicious domains hosting scam websites (i.e. fraudulent tech support, scam products and fake browser extensions).

The attackers have compromised a range of organisations of all types and sizes, without targeting a specific sector. It is highly likely that the operation was intentionally designed and optimised to maximise profits for the money-motivated cyber criminals.

This campaign comes in the wake of several other similar large botnets which are attacking networked devices. To minimise the threat, users should ensure regular patching is undertaken across all device types. Where possible, users should set devices to automatically apply all security updates as they become available.

The NCSC website features advice and guidance for patch management, and readers should also follow the 10 steps to Cyber Security. There is also published guidance on how best to protect against ransomware attacks and mitigating malware.