IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns of new botnet variant targeting Windows and Linux systems

The Sysrv botnet is back and equipped with more exploits though the primary goal of installing cryptominers remains the same

Microsoft has warned businesses that its security experts have encountered a new variant of the Sysrv botnet that supports additional exploits and can gain control of web servers.

The botnet family has been observed since 2020 and is known to target Windows and Linux systems, installing Monero cryptocurrency miners.

The new variant, dubbed Sysrv-K, is wormable and scans the internet for vulnerabilities in web apps and databases to exploit and install itself, Microsoft said in a Twitter thread.

Sysrv-K works similarly to older variants in that it scans for secure shell (SSH) keys, IP addresses, and host names, before trying to spread copies of itself throughout the network.

The wormable nature Sysrv-K is a concern for businesses running either Windows or Linux on internet-facing systems. Microsoft advised everyone to secure all internet-facing systems and patch known security vulnerabilities.

The vulnerabilities used by Sysrv-K are a mixture of older and newer threats and span myriad types including path traversal, remote file disclosures, arbitrary file download, and remote code execution.

One of the new behaviour observed in Sysrv-K, and not previous variants, is its scanning of WordPress configuration files and their backups to retrieve database credentials.

Sysrv-K then uses these harvested credentials to gain control of the web server where it can use its upgraded communication tools, such as access to a Telegram bot.

The Sysrv family

The Sysrv botnet family has been around since December 2020 but its activity first notably spiked around March 2021, prompting cyber security companies like Juniper to analyse the attacks.

Since it was first launched, there have been several improvements to Sysrv, such as compiling both the worm and Monero miner into a single binary last year.

Juniper said combining the two would afford the threat actor “better control and management” as the binary is constantly updated.

As part of the loader’s script, the SSH keys used in the most recent variant were also only added last year before activity started to surge. Researchers said this was another initiative used to gain greater persistence in target machines which could lead to more sophisticated attacks than cryptocurrency mining.

Related Resource

The state of email security 2022

Confronting the new wave of cyber attacks

Whitepaper cover with image of a man walking along a beach, with a line graph overlayFree Download

An NHS Digital analysis of Sysrv concluded that the binary is written in Go, a cross-platform development language that’s becoming increasingly popular among cyber criminals.

Sysrv prepares the infected system by removing any currently installed cryptocurrency miners before terminating services and modifying the system’s firewall.

It then installs the Monero miner - the type of miner may depend on the variant that infects a machine - and looks for ways to move and spread laterally while the miner program runs.

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Recommended

Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible
Business operations

Microsoft blocking Tutanota users from Teams registration, claims fix unfeasible

8 Aug 2022
Microsoft wins five-year digital transformation deal with Australia’s largest telco
digital transformation

Microsoft wins five-year digital transformation deal with Australia’s largest telco

26 Jul 2022
Slack Connect vs Microsoft Teams Connect: Better than email?
collaboration

Slack Connect vs Microsoft Teams Connect: Better than email?

20 Jul 2022
Microsoft announces simulator for autonomous aircraft development
Cloud

Microsoft announces simulator for autonomous aircraft development

20 Jul 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022