# SystemBC Malware Resurges with 10K+ Infections

> SystemBC is a multiplatform SOCKS5 proxy backdoor and malware-as-a-service (MaaS) platform active since August 2019, maintaining 80+ C2 servers with a daily average of 1,500 compromised hosts — primarily VPS servers (~80%) — used by a broad coalition of ransomware affiliates (LockBit, Black Basta, Akira, Conti, Ryuk, Nokoyawa, 8Base, Rhysida, BlackSuit, RansomHub) and commercial proxy services (REM Proxy, VN5Socks) for SOCKS5 tunneling, payload delivery, shellcode injection, and network pivoting.

- **Published:** 2026-02-16T10:18:20Z
- **Last reviewed:** 2026-02-16T10:18:20Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0101
- **ID:** TL-2026-0101
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SystemBC is a commoditized proxy backdoor sold in underground forums since at least 2018, with compiled samples dating to July 2017. The platform consists of three components: (1) C2 web server with PHP admin panel, (2) C2 proxy listener managing SOCKS5 tunnels, and (3) backdoor payload available as both EXE and DLL for Windows, plus a Linux variant. Core capabilities include SOCKS5 proxy establishment from victim to C2 (enabling attackers to pivot through victim networks), a loader for downloading and executing files via scheduled tasks (parent process becomes svchost.exe, evading AV correlation), and fileless shellcode injection directly into memory via VirtualProtect + CreateThread (supporting Meterpreter and other frameworks without disk writes). Communication uses a custom RC4-encrypted protocol with XOR encoding using a hardcoded 40-byte key. Lumen Black Lotus Labs (September 2025) documented the botnet's current scale: 80+ C2 servers operated under a single Autonomous System, daily average of 1,500 active bots with ~80% being compromised VPS from five large commercial providers (NOT residential devices — a deliberate choice for bandwidth and longevity). Approximately 40% of infections persist over one month. The botnet feeds into multiple criminal services including REM Proxy (offering ~80% of SystemBC bots plus 20,000 compromised MikroTik routers), Russian web-scraping services, and Vietnamese VN5Socks proxy service. REM Proxy has documented connections to AvosLocker and Morpheus ransomware groups. Europol's Operation Endgame (May 2024) specifically targeted SystemBC alongside IcedID, SmokeLoader, TrickBot, and BumbleBee in the largest-ever botnet takedown. Kaspersky (August 2023) documented DroxiDat, a compact 8KB SystemBC variant, targeting a South African power utility with Cobalt Strike beacons — attributed with low confidence to FIN12/Pistachio Tempest. Kroll (January 2024) provided the definitive C2 server analysis: the PHP panel manages per-victim SOCKS5 ports with optional authentication (RFC 1929), IP-based access control, loader URL submission, and direct shellcode injection with repeat scheduling. SystemBC remains the most widely-adopted ransomware affiliate tunneling tool, providing persistent network access that survives primary C2 remediation. V1 CORRECTION: The '10K+ infections' claim is inflated — Lumen documented 1,500 daily active bots. Cumulative infections over the botnet's 6+ year lifespan would exceed 10K, but daily active count is 1,500.

## MITRE ATT&CK

- T1572 Protocol Tunneling
- T1090.002 External Proxy
- T1090.003 Multi-hop Proxy
- T1573.001 Symmetric Cryptography
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1053.005 Scheduled Task
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1055 Process Injection
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1021 Remote Services
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1583.005 Botnet
- T1486 Data Encrypted for Impact
- T1573.002 Asymmetric Cryptography
- T1036 Masquerading
- T1584.004 Server
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1003 OS Credential Dumping
- T1027 Obfuscated Files or Information
- T1490 Inhibit System Recovery

## Sources

- [Lumen Black Lotus Labs: SystemBC — Bringing the Noise (80+ C2s, 1,500 daily victims, REM Proxy)](https://blog.lumen.com/systembc-bringing-the-noise/)
- [Kroll: Inside The SYSTEMBC Command-and-Control Server (C2 panel, SOCKS5, loader, shellcode)](https://www.kroll.com/en/insights/publications/cyber/inside-the-systembc-malware-server)
- [Kaspersky: Focus on DroxiDat/SystemBC — South African Power Utility Attack](https://securelist.com/focus-on-droxidat-systembc/110302/)
- [Europol: Operation Endgame — Largest Botnet Takedown (SystemBC + IcedID + SmokeLoader + TrickBot + BumbleBee)](https://www.europol.europa.eu/media-press/newsroom/news/largest-ever-operation-against-botnets-hits-dropper-malware-ecosystem)
- [DFIR Report: Cobalt Strike and a Pair of SOCKS Lead to LockBit Ransomware](https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/)
- [ANSSI: FIN12 — A Cybercriminal Group with Multiple Ransomware (SystemBC across 8+ RaaS families)](https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-007.pdf)
- [Rapid7: Black Basta Campaign Drops Zbot, DarkGate, and SystemBC](https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/)
- [Mandiant M-Trends 2025: UNC4393 (Black Basta) Using SystemBC + QakBot + Cobalt Strike](https://services.google.com/fh/files/misc/m-trends-2025-en.pdf)
- [Malpedia: SystemBC (win.systembc) — Comprehensive Reference Catalog](https://malpedia.caad.fkie.fraunhofer.de/details/win.systembc)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0101