Sysrv-K Botnet Mines

Researchers from Microsoft threat intelligence team has reported that a new variant of the Sysrv botnet, tracked as Sysrv-K active since 2020, that has the exploits for vulnerabilities in the Spring Framework and WordPress. Threat actors use the botnet in a cryptomining campaign targeting Windows and Linux servers.

Sysrv-K leverages the exploits, then take over the vulnerable web servers, the malware targets different issues, including a code injection vulnerability, tracked as CVE-2022-22947, that resides in the Spring Cloud Gateway library.

A remote attacker could send specially-crafted requests to vulnerable systems to gain arbitrary code execution.

The botnet also supports scanning capabilities for WordPress configuration files and their backups, the feature allows operators to access sensitive data, including database credentials.

Like older variants, Sysrv-K scans for SSH keys, IP addresses, and host names, and then attempts to connect to other systems in the network via SSH to deploy copies of itself.

Microsoft Statement

The new variant of the Sysrv botnet supports new communication capabilities, including the ability to use a Telegram bot. It also designed to deploy Monero (XMRig) miners on vulnerable servers and implements wormable capabilities.

Sysrv-hello is a multi-architecture Cryptojacking botnet employs Golang malware compiled into both Linux and Windows payloads. The malware is equal parts XMRig cryptominer and aggressive botnet propagator.

The propagator leverages MySQL and Tomcat brute forcing along with a suite of exploits including those for Atlassian and Apache.The malware also leverages several “No CVE” command execution techniques including those for Jupyter notebook and Tomcat Manager.