IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft warns of new botnet variant targeting Windows and Linux systems

The Sysrv botnet is back and equipped with more exploits though the primary goal of installing cryptominers remains the same

Microsoft has warned businesses that its security experts have encountered a new variant of the Sysrv botnet that supports additional exploits and can gain control of web servers.

The botnet family has been observed since 2020 and is known to target Windows and Linux systems, installing Monero cryptocurrency miners.

The new variant, dubbed Sysrv-K, is wormable and scans the internet for vulnerabilities in web apps and databases to exploit and install itself, Microsoft said in a Twitter thread.

Sysrv-K works similarly to older variants in that it scans for secure shell (SSH) keys, IP addresses, and host names, before trying to spread copies of itself throughout the network.

The wormable nature Sysrv-K is a concern for businesses running either Windows or Linux on internet-facing systems. Microsoft advised everyone to secure all internet-facing systems and patch known security vulnerabilities.

The vulnerabilities used by Sysrv-K are a mixture of older and newer threats and span myriad types including path traversal, remote file disclosures, arbitrary file download, and remote code execution.

One of the new behaviour observed in Sysrv-K, and not previous variants, is its scanning of WordPress configuration files and their backups to retrieve database credentials.

Sysrv-K then uses these harvested credentials to gain control of the web server where it can use its upgraded communication tools, such as access to a Telegram bot.

The Sysrv family

The Sysrv botnet family has been around since December 2020 but its activity first notably spiked around March 2021, prompting cyber security companies like Juniper to analyse the attacks.

Since it was first launched, there have been several improvements to Sysrv, such as compiling both the worm and Monero miner into a single binary last year.

Juniper said combining the two would afford the threat actor “better control and management” as the binary is constantly updated.

As part of the loader’s script, the SSH keys used in the most recent variant were also only added last year before activity started to surge. Researchers said this was another initiative used to gain greater persistence in target machines which could lead to more sophisticated attacks than cryptocurrency mining.

Related Resource

The state of email security 2022

Confronting the new wave of cyber attacks

Whitepaper cover with image of a man walking along a beach, with a line graph overlayFree Download

An NHS Digital analysis of Sysrv concluded that the binary is written in Go, a cross-platform development language that’s becoming increasingly popular among cyber criminals.

Sysrv prepares the infected system by removing any currently installed cryptocurrency miners before terminating services and modifying the system’s firewall.

It then installs the Monero miner - the type of miner may depend on the variant that infects a machine - and looks for ways to move and spread laterally while the miner program runs.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads
Microsoft Windows

Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads

20 Jun 2022
IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated
Business strategy

IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated

17 Jun 2022
Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive
ransomware

Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive

17 Jun 2022
Microsoft silent patches called “a grossly irresponsible policy”
cyber security

Microsoft silent patches called “a grossly irresponsible policy”

15 Jun 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022