IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns of new botnet variant targeting Windows and Linux systems

The Sysrv botnet is back and equipped with more exploits though the primary goal of installing cryptominers remains the same

Microsoft has warned businesses that its security experts have encountered a new variant of the Sysrv botnet that supports additional exploits and can gain control of web servers.

The botnet family has been observed since 2020 and is known to target Windows and Linux systems, installing Monero cryptocurrency miners.

The new variant, dubbed Sysrv-K, is wormable and scans the internet for vulnerabilities in web apps and databases to exploit and install itself, Microsoft said in a Twitter thread.

Sysrv-K works similarly to older variants in that it scans for secure shell (SSH) keys, IP addresses, and host names, before trying to spread copies of itself throughout the network.

The wormable nature Sysrv-K is a concern for businesses running either Windows or Linux on internet-facing systems. Microsoft advised everyone to secure all internet-facing systems and patch known security vulnerabilities.

The vulnerabilities used by Sysrv-K are a mixture of older and newer threats and span myriad types including path traversal, remote file disclosures, arbitrary file download, and remote code execution.

One of the new behaviour observed in Sysrv-K, and not previous variants, is its scanning of WordPress configuration files and their backups to retrieve database credentials.

Sysrv-K then uses these harvested credentials to gain control of the web server where it can use its upgraded communication tools, such as access to a Telegram bot.

The Sysrv family

The Sysrv botnet family has been around since December 2020 but its activity first notably spiked around March 2021, prompting cyber security companies like Juniper to analyse the attacks.

Since it was first launched, there have been several improvements to Sysrv, such as compiling both the worm and Monero miner into a single binary last year.

Juniper said combining the two would afford the threat actor “better control and management” as the binary is constantly updated.

As part of the loader’s script, the SSH keys used in the most recent variant were also only added last year before activity started to surge. Researchers said this was another initiative used to gain greater persistence in target machines which could lead to more sophisticated attacks than cryptocurrency mining.

Related Resource

The state of email security 2022

Confronting the new wave of cyber attacks

Whitepaper cover with image of a man walking along a beach, with a line graph overlayFree Download

An NHS Digital analysis of Sysrv concluded that the binary is written in Go, a cross-platform development language that’s becoming increasingly popular among cyber criminals.

Sysrv prepares the infected system by removing any currently installed cryptocurrency miners before terminating services and modifying the system’s firewall.

It then installs the Monero miner - the type of miner may depend on the variant that infects a machine - and looks for ways to move and spread laterally while the miner program runs.

Featured Resources

2023 Strategic roadmap for data security platform convergence

Capitalise on your data and share it securely using consolidated platforms

Free Download

The 3D trends report

Presenting one of the most exciting frontiers in visual culture

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

Microsoft Azure spending notifications unavailable until March
Cloud

Microsoft Azure spending notifications unavailable until March

2 Feb 2023
Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status
Security

Hackers target business cloud environments by abusing Microsoft’s ‘verified publisher’ status

1 Feb 2023
Google to cut global workforce by 12,000 roles
Careers & training

Google to cut global workforce by 12,000 roles

20 Jan 2023
Windows 11 System Restore bug preventing users from accessing apps
Microsoft Windows

Windows 11 System Restore bug preventing users from accessing apps

19 Jan 2023

Most Popular

What's powering Britain’s fibre broadband boom?
Network & Internet

What's powering Britain’s fibre broadband boom?

3 Feb 2023
Dutch hacker steals data from virtually entire population of Austria
data breaches

Dutch hacker steals data from virtually entire population of Austria

26 Jan 2023
Yandex data breach reveals source code littered with racist language
data breaches

Yandex data breach reveals source code littered with racist language

30 Jan 2023