Thursday, May 1, 2025
HomeCyber Security NewsSysrv botnet Attack Windows, Linux Servers with New Exploits - Microsoft

Sysrv botnet Attack Windows, Linux Servers with New Exploits – Microsoft

Published on

SIEM as a Service

Follow Us on Google News

Using vulnerabilities in Web frameworks and WordPress, the Sysrv botnet now targets vulnerable Windows and Linux servers to deploy crypto-mining malware.

This new variant (tracked as Sysrv-K) discovered by Microsoft may now scan WordPress and Spring deployments for unpatched code.

Here’s what the Microsoft Security Intelligence team stated:-

- Advertisement - Google News

“The new variant, which we call Sysrv-K, sports additional exploits and can gain control of web servers. These vulnerabilities, which have all been addressed by security updates, include old vulnerabilities in WordPress plugins, as well as newer vulnerabilities like CVE-2022-22947.”

This vulnerability (CVE-2022-22947) can be exploited by a remote attacker to gain execution of code on unpatched hosts by exploiting the Spring Cloud Gateway library.

Technical Analysis

As part of these newly added capabilities, Sysrv-K searches for WordPress configuration files and their backups in order to discover database credentials, which can then be used to infiltrate web servers.

Security researchers from Alibaba Cloud (Aliyun) had first discovered this malware in February after it was active since December 2020.

Besides gaining the attention of researchers from Lacework Labs and Juniper Threat Labs, this malware also crossed the radar screens of security researchers in March.

Sysrv exploits the vulnerabilities in Linux and Windows enterprise servers by infecting them with Monero (XMRig) miners, as well as self-spreading malware.

This botnet infiltrates web servers by exploiting vulnerabilities in web applications and databases which can lead to them being compromised. Here are the applications and databases that are exploited:-

  • PHPUnit
  • Apache Solar
  • Confluence
  • Laravel
  • JBoss
  • Jira
  • Sonatype
  • Oracle WebLogic
  • Apache Struts

Upon launching its own payloads and killing competing cryptocurrency miners, Sysrv also spreads over the network automatically. This type of malware is spread by brute force attacks using many of the private keys collected from the servers infected with it.

The aim of this component is to add more vulnerable Windows and Linux systems to its army of Monero mining bots by aggressively scanning the internet for vulnerable machines.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...