Threat video1:00
SystemBC Resurgence With 10K+ Infections: Detection & IOCs
Ransomware crews pivot through SystemBC, which runs 80+ C2 servers and averages 1,500 victims a day. 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for SystemBC Resurgence With 10K+ Infections: Detection & IOCs →
Chapters
- 0:00The hookSystemBC resurges: approximately 1,500 active infections.
- 0:06The storyRansomware platform spreading since 2019.
- 0:11Attack pathRC4-encrypted protocol connects to command and control.
- 0:25AttributionNo threat actor is attributed.
- 0:29Indicators of compromise25 indicators to hunt: 2 IPs, 2 domains and 2 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques29 ATT&CK techniques, from resource development to impact.
- 0:43Remediation5 steps now: Monitor for SOCKS5 proxy connections on high-numbered ports from internal.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00SystemBC resurges: approximately 1,500 active infections.
0:06Ransomware platform spreading since 2019.
0:09It survived and persists.
0:12RC4-encrypted protocol connects to command and control.
0:16Registry and task persistence enable survival.
0:19Cobalt Strike orchestrates lateral movement and ransomware.
0:25No threat actor is attributed. Confidence: none.
0:3025 indicators to hunt: 2 IPs, 2 domains and 2 SHA-256 hashes, and more.
0:3929 ATT&CK techniques, from resource development to impact.
0:435 steps now: Monitor for SOCKS5 proxy connections on high-numbered ports from internal.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.