Tracking Prometei in 2026 — How large is it?
I was browsing through some older articles about malware, half out of boredom and half out of staying up to date about previous campaigns in order to stay more aware, and I came across prometei.
I read an article from TrendMicro about the botnet which goes into a good depth about the operations and code execution flow about the malware, so I won’t go into it, if you wish to read more about the botnet please check them out.
They shared an IOC list for the malware, which made me wonder about the older domains used, since prometei now uses DGA (Domain Generation Algorithm) for generating new C&C domains to control devices. The domain in question for this article is feefreepool.net. Naturally I didn’t go into this with high hopes as I would have assumed the operators would have since switched all devices off the domain, but I figured it was worth a try!
Get Isske’s stories in your inbox
Join Medium for free to get updates from this writer.
I registered the domain and began to track the incoming network traffic, but this is where I was incredibly suprised:
Not only was the domain still active, but there were a large number of devices still in use!
Unfortunately due to the fact that the operators of this malware have asymmetric encryption built in as well as message verification, there is no way to actively remove the malware from these devices, what it does allow us to do is track connections, to get a better sense of the scale Prometei operates/operated at.
I have created a tracker for the malware, which can be found at promtrack.online
As of 22/7/26, there has been 1152 unique devices logged, with over 500k pings
This obviously serves no purpose but to observe, but it is always interesting to see how many infected devices there are out there still waiting on that command to cause more harm. Preventing the operators from controlling more devices is pretty good too :)
