Microsoft warns of new botnet variant targeting Windows and Linux systems
The Sysrv botnet is back and equipped with more exploits though the primary goal of installing cryptominers remains the same
Microsoft has warned businesses that its security experts have encountered a new variant of the Sysrv botnet that supports additional exploits and can gain control of web servers.
The botnet family has been observed since 2020 and is known to target Windows and Linux systems, installing Monero cryptocurrency miners.
The new variant, dubbed Sysrv-K, is wormable and scans the internet for vulnerabilities in web apps and databases to exploit and install itself, Microsoft said in a Twitter thread.
Sysrv-K works similarly to older variants in that it scans for secure shell (SSH) keys, IP addresses, and host names, before trying to spread copies of itself throughout the network.
The wormable nature Sysrv-K is a concern for businesses running either Windows or Linux on internet-facing systems. Microsoft advised everyone to secure all internet-facing systems and patch known security vulnerabilities.
The vulnerabilities used by Sysrv-K are a mixture of older and newer threats and span myriad types including path traversal, remote file disclosures, arbitrary file download, and remote code execution.
One of the new behaviour observed in Sysrv-K, and not previous variants, is its scanning of WordPress configuration files and their backups to retrieve database credentials.
Sysrv-K then uses these harvested credentials to gain control of the web server where it can use its upgraded communication tools, such as access to a Telegram bot.
The Sysrv family
The Sysrv botnet family has been around since December 2020 but its activity first notably spiked around March 2021, prompting cyber security companies like Juniper to analyse the attacks.
Since it was first launched, there have been several improvements to Sysrv, such as compiling both the worm and Monero miner into a single binary last year.
Juniper said combining the two would afford the threat actor “better control and management” as the binary is constantly updated.
As part of the loader’s script, the SSH keys used in the most recent variant were also only added last year before activity started to surge. Researchers said this was another initiative used to gain greater persistence in target machines which could lead to more sophisticated attacks than cryptocurrency mining.
The state of email security 2022
Confronting the new wave of cyber attacksFree Download
Sysrv prepares the infected system by removing any currently installed cryptocurrency miners before terminating services and modifying the system’s firewall.
It then installs the Monero miner - the type of miner may depend on the variant that infects a machine - and looks for ways to move and spread laterally while the miner program runs.
The state of Salesforce: Future of business
Three articles that look forward into the changing state of Salesforce and the future of businessFree Download
The mighty struggle to migrate SAP to the cloud may be over
A simplified and unified approach to delivering Enterprise Transformation in the cloudFree Download
The business value of the transformative mainframe
Modernising on the mainframeFree Download
The Total Economic Impact™ Of IBM FlashSystem
Cost savings and business benefits enabled by FlashSystemFree Download