Pierluigi Paganini
May 15, 2022
Microsoft Security Intelligence team Microsoft reported that a new variant of the Sysrv botnet, tracked as Sysrv-K, now includes exploits for vulnerabilities in the Spring Framework and WordPress. Threat actors use the botnet in a cryptomining campaign targeting Windows and Linux servers.
We encountered a new variant of the Sysrv botnet, known for exploiting vulnerabilities in web apps and databases to install coin miners on both Windows and Linux systems. The new variant, which we call Sysrv-K, sports additional exploits and can gain control of web servers.
— Microsoft Threat Intelligence (@MsftSecIntel) May 13, 2022
The botnet has been active since at least the end of 2020, but its activity was documented in April 2021 by multiple security researchers.
Sysrv-K leverages the exploits to take over the vulnerable web servers, the malware targets different issues, including a code injection vulnerability, tracked as CVE-2022-22947, that resides in the Spring Cloud Gateway library. A remote attacker could send specially-crafted requests to vulnerable systems to gain arbitrary code execution.
The botnet also supports scanning capabilities for WordPress configuration files and their backups, the feature allows operators to access sensitive data, including database credentials.
“Like older variants, Sysrv-K scans for SSH keys, IP addresses, and host names, and then attempts to connect to other systems in the network via SSH to deploy copies of itself.” reads a Tweet published by Microsoft.
Microsoft experts also observed the new variant of the Sysrv botnet supports new communication capabilities, including the ability to use a Telegram bot.
Like older variants, Sysrv-K scans for SSH keys, IP addresses, and host names, and then attempts to connect to other systems in the network via SSH to deploy copies of itself. This could put the rest of the network at risk of becoming part of the Sysrv-K botnet.
— Microsoft Threat Intelligence (@MsftSecIntel) May 13, 2022
The Sysrv was designed to deploy Monero (XMRig) miners on vulnerable servers and implements wormable capabilities.
“Sysrv-hello is a multi-architecture Cryptojacking (T1496) botnet that first emerged in late 2020, and employs Golang malware compiled into both Linux and Windows payloads. The malware is equal parts XMRig cryptominer and aggressive botnet-propagator. The propagator leverages MySQL and Tomcat brute forcing (T1110) along with a suite of exploits including those for Atlassian and Apache.” reads an analysis published by Lacework last year. “The malware also leverages several “No CVE” command execution techniques including those for Jupyter notebook and Tomcat Manager.”
Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Sysrv botnet)
[adrotate banner=”5″]
[adrotate banner=”13″]
