New Sysrv Botnet Abuses Google Subdomain To Spread XMRig Miner

Imperva researchers analyzed a Sysrv botnet variant (first seen 2020) that uses a Golang worm/dropper to exploit Apache Struts and Atlassian Confluence vulnerabilities, terminate security processes, spread via SSH and compromised domains, and deploy an XMRig Monero miner. The report details the infection chain, improved persistence and obfuscation techniques, second-stage binaries hosted on a Google subdomain, mining pool endpoints and wallet, and provides IoCs (URLs, file hashes) to aid detection and mitigation.