Loading story…
The Sysrv-hello cryptomining botnet compromises vulnerable Windows and Linux enterprise servers to deploy XMRig Monero miners and spread to additional systems. Observed since December 2020, it exploits remote code execution vulnerabilities in internet-facing applications and reuses SSH keys recovered from compromised servers for lateral movement. The malware evolved from separate mining and propagation components into a single binary and removes competing cryptocurrency miners from infected hosts. Researchers identified mining wallets associated with F2Pool and Nanopool, indicating illicit cryptocurrency earnings.
Follow-up reporting from Juniper and Lacework highlighted persistence and infrastructure expansion, respectively, extending concerns beyond the botnet’s initial exploitation activity. The combination of application exploitation, credential reuse, and self-propagation exposes organizations to unauthorized compute consumption and broader server compromise. Defenders should prioritize patching exposed applications, investigate unexpected mining processes and resource usage, and audit SSH access. Compromised SSH keys should be revoked or rotated, while affected hosts should be checked for persistence and evidence of lateral movement.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Alibaba Cloud researchers reported that Sysrv-hello had been active since December 2020. The botnet compromises vulnerable enterprise servers to deploy XMRig Monero miners and self-spreading malware.
Recent Sysrv-hello samples added support for Nanopool and removed support for MineXMR. Juniper identified a Nanopool-associated wallet that collected 8 XMR between March 1 and March 28, valued at approximately $1,700 in the article.
Lacework Labs recovered a Sysrv-hello XMRig configuration containing a Monero wallet associated with F2Pool. The wallet held just over 12 XMR, valued at approximately $4,000 at the time of reporting.
Juniper examined samples collected after the March activity surge and identified exploitation techniques targeting Mongo Express, XML-RPC, SaltStack, Drupal Ajax, ThinkPHP, and XXL-JOB. The findings documented Sysrv-hello's exploitation of remote code execution flaws to spread.
Sysrv-hello evolved from separate miner and worm components into a single binary capable of both cryptocurrency mining and propagation.
A surge in Sysrv-hello activity during March prompted investigations by Lacework Labs and Juniper Threat Labs.
Alibaba Cloud security researchers first spotted the botnet in February and named it Sysrv-hello. The supplied content does not explicitly state the year of discovery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Sysrv** botnet is actively compromising Linux and Windows servers to deploy **XMRig** Monero miners, using a Golang worm that scans for exposed services, brute-forces weak credentials, and exploits known flaws including `CVE-2020-14882` and `CVE-2017-11610`. The malware has targeted MySQL, Tomcat admin panels, Jenkins, and Oracle WebLogic, then retrieves platform-specific loader scripts and additional worm copies from attacker-controlled infrastructure. On Linux, samples unpack embedded miners from the Golang binary, use TCP port `52013` as a mutex, establish persistence with cron, copy themselves into directories such as `/boot` and `/boot/efi`, and in some cases alter `/etc/hosts` to support mining pool connectivity.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026