Wednesday, May 22, 2024

Sysrv botnet Attack Windows, Linux Servers with New Exploits – Microsoft

Using vulnerabilities in Web frameworks and WordPress, the Sysrv botnet now targets vulnerable Windows and Linux servers to deploy crypto-mining malware.

This new variant (tracked as Sysrv-K) discovered by Microsoft may now scan WordPress and Spring deployments for unpatched code.

Here’s what the Microsoft Security Intelligence team stated:-

“The new variant, which we call Sysrv-K, sports additional exploits and can gain control of web servers. These vulnerabilities, which have all been addressed by security updates, include old vulnerabilities in WordPress plugins, as well as newer vulnerabilities like CVE-2022-22947.”

This vulnerability (CVE-2022-22947) can be exploited by a remote attacker to gain execution of code on unpatched hosts by exploiting the Spring Cloud Gateway library.

Technical Analysis

As part of these newly added capabilities, Sysrv-K searches for WordPress configuration files and their backups in order to discover database credentials, which can then be used to infiltrate web servers.

Security researchers from Alibaba Cloud (Aliyun) had first discovered this malware in February after it was active since December 2020.

Besides gaining the attention of researchers from Lacework Labs and Juniper Threat Labs, this malware also crossed the radar screens of security researchers in March.

Sysrv exploits the vulnerabilities in Linux and Windows enterprise servers by infecting them with Monero (XMRig) miners, as well as self-spreading malware.

This botnet infiltrates web servers by exploiting vulnerabilities in web applications and databases which can lead to them being compromised. Here are the applications and databases that are exploited:-

  • PHPUnit
  • Apache Solar
  • Confluence
  • Laravel
  • JBoss
  • Jira
  • Sonatype
  • Oracle WebLogic
  • Apache Struts

Upon launching its own payloads and killing competing cryptocurrency miners, Sysrv also spreads over the network automatically. This type of malware is spread by brute force attacks using many of the private keys collected from the servers infected with it.

The aim of this component is to add more vulnerable Windows and Linux systems to its army of Monero mining bots by aggressively scanning the internet for vulnerable machines.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...

DoppelGänger Attack: Malware Routed Via News Websites And Social Media

A Russian influence campaign, DoppelGänger, leverages fake news websites (typosquatted and independent) to spread...

Critical Memory Corruption In Cloud Logging Infrastructure Enables Code Execution Attack

A new critical vulnerability has been discovered in Fluent Bit's built-in HTTP server, which...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles