Microsoft has warned businesses that its security experts have encountered a new variant of the Sysrv botnet that supports additional exploits and can gain control of web servers.
The botnet family has been observed since 2020 and is known to target Windows and Linux systems, installing Monero cryptocurrency miners.
The new variant, dubbed Sysrv-K, is wormable and scans the internet for vulnerabilities in web apps and databases to exploit and install itself, Microsoft said in a Twitter thread.
Sysrv-K works similarly to older variants in that it scans for secure shell (SSH) keys, IP addresses, and host names, before trying to spread copies of itself throughout the network.
The wormable nature Sysrv-K is a concern for businesses running either Windows or Linux on internet-facing systems. Microsoft advised everyone to secure all internet-facing systems and patch known security vulnerabilities.
The vulnerabilities used by Sysrv-K are a mixture of older and newer threats and span myriad types including path traversal, remote file disclosures, arbitrary file download, and remote code execution.
One of the new behaviour observed in Sysrv-K, and not previous variants, is its scanning of WordPress configuration files and their backups to retrieve database credentials.
Sysrv-K then uses these harvested credentials to gain control of the web server where it can use its upgraded communication tools, such as access to a Telegram bot.
The Sysrv family
The Sysrv botnet family has been around since December 2020 but its activity first notably spiked around March 2021, prompting cyber security companies like Juniper to analyse the attacks.
Since it was first launched, there have been several improvements to Sysrv, such as compiling both the worm and Monero miner into a single binary last year.
Juniper said combining the two would afford the threat actor “better control and management” as the binary is constantly updated.
As part of the loader’s script, the SSH keys used in the most recent variant were also only added last year before activity started to surge. Researchers said this was another initiative used to gain greater persistence in target machines which could lead to more sophisticated attacks than cryptocurrency mining.
An NHS Digital analysis of Sysrv concluded that the binary is written in Go, a cross-platform development language that’s becoming increasingly popular among cyber criminals.
Sysrv prepares the infected system by removing any currently installed cryptocurrency miners before terminating services and modifying the system’s firewall.
It then installs the Monero miner - the type of miner may depend on the variant that infects a machine - and looks for ways to move and spread laterally while the miner program runs.
