Sysrv-hello Botnet

The Sysrv-hello Botnet is a malicious project, which has been tracked closely by cybersecurity researchers since December 2020. The criminals behind this campaign are aiming to install a cryptocurrency miner on compromised Windows and Linux systems and then use their hardware resources to mine for Monero (XMR,) a privacy-focused cryptocurrency. Monero is being used for all sorts of shady online deals around the world, and cybercriminals express significant interest in amassing as much of it as possible.

The Sysrv-hello Botnet, in particular, does not go after regular home devices – instead, It focuses its efforts on enterprise servers, which are likely to pack more processing power than your average computer. By harvesting these resources for cryptocurrency mining, the criminals can net impressive profit – one of the wallets linked to the Sysrv-hello Botnet campaign has 12 XMR (around $4,000.) However, it is very likely that the hackers use many other unidentified wallets to store their loot.

The good news is that this fairly modern cryptocurrency mining operation is not relying on zero-day exploits, which could prove to be a major issue. Instead, the criminals are scanning Linux and Windows servers for unpatched software, which is exploitable through vulnerabilities that may often be a few years old. Some of the software packages that the Sysrv-hello Botnet tries to exploit are PHPUnit, Oracle WebLogic, Apache Struts, Confluence, Laravel, Jira, and others. Network administrators must make sure to keep their systems protected by keeping all software packages up-to-date, as well as by using strong-passwords and following the best security practices.

In terms of functionality, the Sysrv-hello Botnet does not do much besides dropping the cryptocurrency miner payload. Just like other botnets of this type, it also scans the system for other miner instances and terminates them to ensure that no other criminals will profit from the compromised server. For example, more advanced projects of this type tend to mask the malicious process' hardware usage, therefore hiding the fact that an unknown service is using 80-90% of processing power. In a similar fashion, some cryptocurrency miners pause their tasks as soon as a hardware resource monitoring tool is open – another easy to trick to avoid being detected. Thankfully, the Sysrv-hello Botnet does not do such things, and knowledgeable system administrators should be able to easily identify and mitigate the threat via manual removal, or by using reputable antivirus software.