SystemBC
Also known as: Coroxy, DroxiDat
SystemBC is a multiplatform proxy malware active since August 2019. It creates SOCKS5 network tunnels in the victim’s network and connects to its C2 server using a custom, RC4-encrypted protocol. It can also download and execute additional malware, with payloads either written to disk or mapped into memory. The SystemBC kit, including the C2 panel, server, and malware executables, is sold in underground forums.
Linked Threat Actors
Last 7 days
No activity observed in the last 7 days.
Further Reading
Microsoft coined the term “human-operated ransomware” to clearly define a class of attack driven by expert human intelligence at every step of the attack chain and culminate in intentional business...
Microsoft coined the term “human-operated ransomware” to clearly define a class of attack driven by expert human intelligence at every step of the attack chain and culminate in intentional business...
Rapid7 identified multiple intrusion attempts by threat actors utilizing TTPs that are consistent with an ongoing social engineering campaign being tracked.
In early October, Rapid7 has observed a resurgence of activity related to the ongoing social engineering campaign by Black Basta ransomware operators.
Our expert Threat Hunting team shares its assessment of a Gootloader incident and details the specific tactics, techniques, and procedures (TTPs) of the attackers.