CryptBot exploits search engine optimization (SEO) and partnerships with other malware operators to propagate its reach. CryptBot primarily spreads through websites offering fake cracked software.

Intrinsec’s analysis reveals operational similarities between PROSPERO and Proton66. Both systems share nearly identical peering agreements and are linked to the same internet exchange point in St. Petersburg.