Microsoft Identifies Botnet Variant Targeting Windows and Linux Systems

Microsoft has warned it has identified a new variant of the Sysrv botnet, which deploys coin miners on equally Windows and Linux units.

In a thread posted on the Microsoft Security Intelligence (@MsftSecIntel) Twitter account, the tech giant exposed the new variant, which it has named Sysrv-K, is exploiting vulnerabilities in the Spring Framework and WordPress to deploy cryptocurrency miners on these techniques.

Microsoft spelled out that the botnet “scans the internet to find web servers with various vulnerabilities to put in by itself.” These vulnerabilities assortment from path traversal and distant file disclosure to arbitrary file download and distant code execution.

Sysrv-K targets a combination of outdated vulnerabilities, such as those people found in WordPress plugins and newer types like CVE-2022-22947. All of these have patches, according to Microsoft.

Worryingly, this new edition appears to have quite a few new options. These incorporate scanning for WordPress configuration documents and their backups to retrieve database qualifications, which it employs to acquire control of the webserver. In addition, “Sysvr-K has up to date communication abilities, such as the skill to use a Telegram bot.”

As with earlier versions, Sysrv-K scans for SSH keys, IP addresses and hostnames in advance of seeking to unfold copies of by itself through the network. This “could put the relaxation of the network at risk of becoming component of the Sysrv-K botnet.”

Microsoft encouraged organizations managing both Windows or Linux on internet-experiencing methods to acquire action to shield on their own from the new botnet, such as putting in all accessible security updates. “We extremely advocate organizations to protected internet-going through programs, like timely software of security updates and setting up credential hygiene,” it tweeted.

Final 7 days, Microsoft announced it had issued fixes for three zero-working day vulnerabilities in its every month patch Tuesday roundup. The tech huge also a short while ago revealed a post outlining how the current ransomware-as-a-company (RaaS) pandemic is becoming fuelled by the resources and companies available by ‘gig’ personnel.

Some parts of this article are sourced from:
www.infosecurity-magazine.com