⚠️ Overview

Sysrv-hello is a Golang-based cryptocurrency mining botnet first identified in February 2020 by security researchers at Trend Micro, categorized as a hybrid malware combining worm-like propagation with coin miner and backdoor capabilities. The malware, attributed to an unknown threat actor group, targets both Windows and Linux servers primarily in cloud and enterprise environments, leveraging a modular architecture to deploy the XMRig miner for Monero (XMR) theft.

🔧 Technical Capabilities

Sysrv-hello spreads through multiple attack vectors, including exploitation of unprotected Redis instances, Jenkins servers via CVE-2022-22954, and Atlassian Confluence via CVE-2022-26134, along with SSH brute-forcing and credential theft from stored configurations. It maintains persistence through cron jobs on Linux and scheduled tasks on Windows, using AES-encrypted C2 communication over HTTPS to retrieve mining payloads and exfiltrate host data. The worm component scans local networks for vulnerable services and copies itself via SSH keys, while evasion techniques include process hiding, disabling security tools, and using polymorphic binary generation. It also drops a web shell (e.g., `shell.jsp`) on compromised Tomcat servers for remote access.

📜 History & Notable Incidents

First observed in early 2020, Sysrv-hello gained notoriety in a campaign during May 2021 targeting unpatched Apache Tomcat servers, exploiting CVE-2020-9484 (session persistence) and CVE-2020-15778 (OpenSSH command injection). A major wave in June 2022 exploited the Confluence vulnerability CVE-2022-26134, infecting thousands of servers worldwide and causing significant resource theft. No law enforcement actions have been publicly documented.

🔍 Detection Indicators

Network indicators include outbound connections to mining pools (e.g., `pool.supportxmr.com`) and C2 domains with `.xyz` or `.top` TLDs; common user-agent strings include `Go-http-client/1.1`. File indicators include the MD5 hash `c3a5c5c5c5c5c5c5c5c5c5c5c5c5c5c5` (example – actual hashes vary per variant) and the mutex name `GlobalSysrvHello`. Registry persistence keys under `HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun` for `winupdate.exe` are typical on Windows.

☠️ Risk & Impact

Sysrv-hello causes severe resource exhaustion by hijacking CPU/GPU for Monero mining, leading to increased electricity costs and degraded system performance for affected organizations. The backdoor component enables data exfiltration and lateral movement, with targeted sectors including cloud hosting providers, e-commerce, and technology companies. Financial losses are primarily indirect, stemming from cloud compute overuse and incident response costs.

🛡️ Mitigation

Defenders should apply patches for all exploited CVEs (e.g., CVE-2022-26134, CVE-2022-22954), disable unnecessary services such as Redis exposed to the internet, and enforce strong SSH credentials. Use EDR tools to detect anomalous process creation and network connections to known mining pools; MITRE ATT&CK IDs T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), and T1569 (System Services) provide detection guidance.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.