TF-MAL-elf.systembc

Description

ThreatFox malware family `elf.systembc`. Printable name: SystemBC.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• SystemBC Botnet Hijacked 10,000 Devices Worldwide to Use for DDoS Attacks
  web:cybersecuritynews.com

  The SystemBC malware family , a persistent threat first documented in 2019, has evolved into a massive botnet infrastructure controlling over 10,000 hijacked devices globally. Functioning primarily as a SOCKS5 proxy and a backdoor, this malware enables threat actors to mask their malicious traffic and maintain long-term access to compromised networks. By converting infected systems into relays ...

  2026-05-22 05:23 UTC
• SystemBC: The Ransomware Enabler Hiding in Plain Sight
  web:intel.mjolnirsecurity.com

  SystemBC is a C-language proxy backdoor first observed in June 2019, originally sold as an underground networking tool. It has since evolved into a critical enabler for ransomware operations, providing encrypted SOCKS5 proxy tunneling and TOR-based command-and-control to groups including Ryuk, Conti, DarkSide (Colonial Pipeline), and Black Basta. SystemBC was initially marketed on Russian ...

  2026-05-22 05:23 UTC
• SystemBC (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  SystemBC is a multiplatform proxy malware active since August 2019. It creates SOCKS5 network tunnels in the victim's network and connects to its C2 server using a custom, RC4-encrypted protocol. It can also download and execute additional malware , with payloads either written to disk or mapped into memory. The SystemBC kit, including the C2 panel, server, and malware executables, is sold in ...

  2026-05-22 05:23 UTC
• DFIR Report - The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy
  web:research.checkpoint.com

  SystemBC Infections During an incident response case, an affiliate of The Gentlemen Ransomware‑as‑a‑Service (RaaS) deployed SystemBC , a proxy malware , on the compromised host. SystemBC establishes SOCKS5 network tunnels within the victim's environment and connects to its C&C server using a custom RC4‑encrypted protocol.

  2026-05-22 05:23 UTC
• SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks
  web:thehackernews.com

  SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks Ravie Lakshmanan Jan 25, 2024 Remote Access Trojan Cybersecurity researchers have shed light on the command-and-control (C2) server workings of a known malware family called SystemBC .

  2026-05-22 05:23 UTC
• The Gentlemen ransomware now uses SystemBC for bot-powered attacks
  web:www.bleepingcomputer.com

  A SystemBC proxy malware botnet of more than 1,570 hosts, believed to be corporate victims, has been discovered following an investigation into a Gentlemen ransomware attack carried out by a gang ...

  2026-05-22 05:23 UTC
• SystemBC Botnet Analysis: Over 10,000 Devices Infected and How ... - DELine
  web:www.de-line.net

  This article provides an in-depth analysis of the SystemBC botnet's infection vectors, core functionalities, and defense strategies. It highlights how SystemBC infects devices via Exchange ProxyShell vulnerabilities and phishing emails to build a large proxy network. The article also recommends multi-layered defenses including patching, traffic monitoring, malicious file scanning, and access ...

  2026-05-22 05:23 UTC
• Inside The SYSTEMBC Malware Server | Cyber Risk | Kroll
  web:www.kroll.com

  Throughout Q2 and Q3 2023, Kroll has observed an increased use of the malicious " SYSTEMBC " tool to maintain access in a compromised network. Our experts conducted research into the SYSTEMBC command and control (C2) server. Learn more.

  2026-05-22 05:23 UTC
• SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown
  web:www.securityweek.com

  Malware & Threats SystemBC Infects 10,000 Devices After Defying Law Enforcement Takedown The malware is known for dropping ransomware and other payloads, and for abusing infected machines to proxy traffic.

  2026-05-22 05:23 UTC
• CRITICAL: SystemBC Historical Bot Infections Special Report
  web:www.shadowserver.org

  The data in this SystemBC Historical Bot Infections Special Report was provided to Shadowserver by the Operation Endgame Law Enforcement partners to disseminate to National CERTs/CSIRTs and network owners globally, to maximize remediation efforts.

  2026-05-22 05:23 UTC

Only Available for Registered Users. Sign in to view.