The Gentlemen Ransomware Operationalizes SystemBC SOCKS5 Botnet of 1,570+ Corporate Hosts for Double-Extortion Operations

Key facts

Detection coverage

As of 2026-04-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0399 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SystemBC Loader Execution via rundll32 — Exploitation Phase

Detects rundll32.exe executing sysbc.dll (or any DLL under C:\ProgramData\Microsoft\Network\) with the 'Start' export. This is the canonical SystemBC loader invocation observed across The Gentlemen ransomware intrusions documented by Black Lotus Labs (Lumen) and BleepingComputer in April 2026. Fires on the initial-access to foothold transition.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1218.011, T1105
• Data sources: sysmon, windows_security, edr_process_events, microsoft_defender_xdr
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\rundll32.exe" (CommandLine="*sysbc.dll*" OR CommandLine="*\\ProgramData\\Microsoft\\Network\\*" OR CommandLine="*,Start*") earliest=-24h@h
| eval ioc_path=if(match(CommandLine, "(?i)ProgramData\\\\Microsoft\\\\Network"), "ioc_path_match", "no")
| eval ioc_file=if(match(CommandLine, "(?i)sysbc\\.dll"), "ioc_file_match", "no")
| eval ioc_export=if(match(CommandLine, "(?i),\\s*Start"), "ioc_export_match", "no")
| where ioc_file="ioc_file_match" OR (ioc_path="ioc_path_match" AND ioc_export="ioc_export_match")
| stats min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parent_images count by host User Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image parent_images cmdlines count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_any ("sysbc.dll", @"ProgramData\Microsoft\Network")
   or (ProcessCommandLine has @"ProgramData\Microsoft\Network" and ProcessCommandLine matches regex @",\s*Start\b")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| summarize first_seen=min(Timestamp), last_seen=max(Timestamp), cmdlines=make_set(ProcessCommandLine, 10), parents=make_set(InitiatingProcessFileName, 10), hits=count() by DeviceName, AccountName

Sigma

title: SystemBC Loader Execution via rundll32 (The Gentlemen — TL-2026-0399)
id: 2c3f0399-1001-4a01-9b2f-tl20260399101
status: experimental
description: Detects rundll32.exe invocations whose command line matches the SystemBC drop path (C:\ProgramData\Microsoft\Network\) and/or the IOC filename sysbc.dll with the 'Start' export — the canonical The Gentlemen / SystemBC loader pattern.
references:
    - https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-leverages-systembc-proxy-botnet-of-1570-corporate-hosts/
    - https://blog.lumen.com/systembc-rat-wants-you-to-buy-it-now/
    - https://attack.mitre.org/software/S0603/
author: Threadlinqs Team
date: 2026/04/20
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218.011
    - attack.t1105
    - threadlinqs.TL-2026-0399
logsource:
    product: windows
    category: process_creation
detection:
    selection_image:
        Image|endswith: '\rundll32.exe'
    selection_sysbc:
        CommandLine|contains: 'sysbc.dll'
    selection_path_and_export:
        CommandLine|contains|all:
            - 'ProgramData\Microsoft\Network\'
            - ',Start'
    condition: selection_image and (selection_sysbc or selection_path_and_export)
falsepositives:
    - None expected — sysbc.dll is a SystemBC IOC filename and ProgramData\Microsoft\Network is not a standard Microsoft-written path.
level: high

Known false positives:

• None expected for the sysbc.dll filename. Rare admin/tooling that legitimately drops helper DLLs under C:\ProgramData\Microsoft\Network\ — verify digital signature and image hash before excluding.

Tuning notes: Baseline rundll32 parent processes in the environment (explorer.exe, svchost.exe, wermgr.exe). Exclude signed Microsoft DLLs by adding an allowlist on SHA256/Signer fields. If environment uses ProgramData for legitimate DLLs, restrict the path-based branch to require the ',Start' export.

• 🔒 SystemBC Loader Drop and Linux Cron Persistence — Exploitation Phase · unlock with TL Creds
• 🔒 SystemBC Run-Key Persistence and LSASS Credential Access — Post-Exploitation Phase · unlock with TL Creds
• 🔒 SystemBC Domain Resolution and Rclone Cloud Exfiltration — C2 and Exfiltration Phase · unlock with TL Creds
• 🔒 Gentlemen Ransom Note Drop and .gntlm Extension Rename — Exploitation Terminal Marker · unlock with TL Creds
• 🔒 SystemBC Persistence Artifacts (Run Key, Service, Linux Cron) — Post-Exploitation Phase · unlock with TL Creds
• 🔒 SystemBC Anomalous Outbound Tunnel from Proxy-Genealogy Process — Lateral Movement Phase · unlock with TL Creds
• 🔒 Shadow Copy Deletion Pre-Ransomware Anti-Recovery — Post-Exploitation Phase · unlock with TL Creds
• 🔒 SystemBC SOCKS5 Beacon to IOC Ports and Infrastructure — C2 Phase · unlock with TL Creds

Indicators of compromise

As of 2026-04-20, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-0399.

Sample indicators (3 of 32)

• IP address: 185.25.51[.]173
• Domain: systembc-panel[.]su
• File hash: 8f6b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

Technical analysis

The Gentlemen is a ransomware-as-a-service (RaaS) operation that surfaced in late 2025 with double-extortion attacks against manufacturing, logistics, legal, and healthcare verticals across North America and Western Europe. Independent research published in April 2026 by BleepingComputer and Lumen's Black Lotus Labs documents the group's operational integration with SystemBC — a malware family first sold on Russian-speaking underground forums in 2018–2019 as a generic SOCKS5 proxy and loader. Historically, SystemBC was bundled with Conti, Ryuk, Royal, Hive, and Egregor intrusions as a tertiary C2 relay; the 2026 campaign represents the first publicly disclosed fusion in which the proxy botnet itself is treated as primary operational infrastructure for a single ransomware brand.

Black Lotus Labs' April 2026 telemetry identifies a persistent backbone of more than 1,570 simultaneously-active SystemBC nodes, the vast majority of which are compromised corporate hosts (Windows servers, workstations, and Linux systems running legacy web applications). Affiliates of The Gentlemen route reconnaissance scans, Cobalt Strike beacons, Rclone exfiltration, and ransomware payload stagers through these nodes, causing malicious traffic to originate from the trusted ASN ranges of victim peers. The botnet is tiered: an outer ring of short-lived residential proxies absorbs scanning and credential-testing traffic, while a long-lived inner ring of compromised corporate hosts is reserved for hands-on-keyboard intrusions.

Initial access vectors observed in The Gentlemen intrusions include opportunistic exploitation of unpatched perimeter appliances (Fortinet FortiOS, Ivanti Connect Secure, Citrix NetScaler), phishing delivery of SocGholish and GootLoader frameworks that drop SystemBC as second-stage, and purchase of network access from initial access brokers. Once footholds are established, operators deploy a customized SystemBC variant (internal version string 3.3.2) that communicates with a hard-coded C2 list over a proprietary binary protocol on TCP ports 4001, 4044, and 4444, and establishes SOCKS5 listeners that the ransomware tooling proxies through. Post-compromise tooling includes Cobalt Strike 4.9, Sliver, Impacket's secretsdump.py, Mimikatz, AnyDesk/ScreenConnect for persistence, and Rclone for data staging to Mega.nz and BackBlaze B2 buckets before the ransomware payload executes.

The ransomware payload itself is a Go-based encryptor branded as 'Gentlemen-Locker' that uses ChaCha20 for file encryption with per-file keys protected by an X25519 hybrid scheme, appends the extension `.gntlm`, and drops a ransom note (`HOW-TO-DECRYPT-GENTLEMEN.txt`) containing a victim-unique Tor .onion negotiation portal. Leak-site data from the group's Tor dark-web portal confirms at least 47 named victims between December 2025 and April 2026, with initial ransom demands ranging from USD 480,000 to USD 9.2 million. The fusion of botnet proxy infrastructure with the ransomware brand dramatically reduces affiliate operating costs: Lumen estimates that the SystemBC backbone saves affiliates approximately USD 200 per hour in residential-proxy rental fees while providing significantly higher trust scores for egress traffic.

Defenders should treat any host beaconing to the SystemBC IOC list as a pre-ransomware indicator and trigger containment playbooks rather than routine cleanup. Network detection should focus on the distinctive SystemBC protocol handshake (little-endian length-prefixed binary frames, sub-200-byte initial registration), anomalous outbound SOCKS5 listeners on corporate assets, and process-genealogy signatures where RunDLL32, WerFault, or svchost spawn children communicating to high ports on sparse-reputation IPs. EDR should alert on the combination of Rclone execution, LSASS access by non-SYSTEM processes, and Volume Shadow Copy deletion within a 30-minute window.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1555 Credentials from Password Stores

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Discovery

T1016 System Network Configuration Discovery; T1018 Remote System Discovery; T1482 Domain Trust Discovery

Lateral Movement

T1021 Remote Services; T1570 Lateral Tool Transfer

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1218 System Binary Proxy Execution

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Persistence

T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1055 Process Injection; T1548 Abuse Elevation Control Mechanism

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1569 System Services

Command and Control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Remediation

Patches

• Ensure all perimeter SSL-VPN and edge appliances are patched to vendor-current versions (FortiOS 7.4.5+, Ivanti Connect Secure 22.7R2.6+, Citrix NetScaler 14.1-29.72+).
• Patch Windows endpoints for LSASS protection (Credential Guard, RunAsPPL), and enable ASR rule 'Block credential stealing from LSASS' (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2).
• Ensure antivirus/NGAV signatures are current: SystemBC 3.x is detected by major vendors as Backdoor:Win32/SystemBC, Trojan.SystemBC, or Proxy.SystemBC.

Immediate actions

• Block all SystemBC C2 IPs and domains in this report at perimeter firewalls, cloud egress gateways, and DNS resolvers (RPZ).
• Hunt for outbound TCP connections to high ports (4001, 4044, 4444) from non-developer workstations and servers — isolate matching hosts.
• Search EDR for process genealogy: rundll32.exe or regsvr32.exe spawning children that establish external SOCKS5 listeners or connect to flagged IOC ranges.
• Force credential rotation for any account that logged into a host observed beaconing to SystemBC infrastructure within the last 90 days.
• Disable outbound traffic on ports 4001, 4044, and 4444 enterprise-wide unless explicitly documented business justification exists.
• Query recent proxy / NetFlow logs for the SystemBC binary handshake pattern (short length-prefixed registration packet followed by bidirectional encrypted tunnel).

Workarounds

• Where patching edge appliances is not immediately possible, restrict management interfaces to trusted admin IPs only and disable unused web UIs.
• Temporarily disable SOCKS5-capable applications (e.g., Proxifier, FoxyProxy) across managed endpoints via application control policies.
• Enforce outbound firewall deny-by-default for endpoints that do not require direct internet egress (server VLANs, OT/ICS, finance workstations).

Longer-term hardening

• Deploy EDR with behavioral detection for proxy-chaining, anomalous outbound tunnels, and SOCKS5 listeners bound on corporate endpoints.
• Implement egress filtering with allow-lists for server tiers; restrict workstation egress to a web proxy with TLS inspection where policy permits.
• Segment corporate networks so compromised user workstations cannot host inbound connections from external IPs (default-deny inbound at host firewall).
• Enable immutable, offline, and offsite backups with tested restore procedures; confirm backup repositories are isolated from domain authentication.
• Deploy canary files and honeytokens in file shares; alert on any touch, especially by service accounts or after-hours sessions.
• Standardize disabling of Volume Shadow Copy deletion via domain GPO and alert on `vssadmin delete shadows` and `wbadmin delete catalog` invocations.
• Harden perimeter appliances (FortiOS, Ivanti Connect Secure, Citrix NetScaler): patch monthly, enable MFA, monitor admin panel auth, rotate keys quarterly.

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows 10; Windows 11; Windows Server 2016; Windows Server 2019; Windows Server 2022
• Linux — Linux distributions (any glibc-based)
  Vulnerable versions: RHEL 7/8/9; Ubuntu 18.04/20.04/22.04; Debian 10/11/12; CentOS 7
• Fortinet — FortiOS / FortiGate (initial access vector)
  Vulnerable versions: 7.0.x <7.0.14; 7.2.x <7.2.7; 7.4.x <7.4.5
  Fixed in: 7.0.14; 7.2.7; 7.4.5
• Ivanti — Connect Secure / Policy Secure (initial access vector)
  Vulnerable versions: <22.7R2.6
  Fixed in: 22.7R2.6
• Citrix — NetScaler ADC / Gateway (initial access vector)
  Vulnerable versions: <14.1-29.72; <13.1-55.34
  Fixed in: 14.1-29.72; 13.1-55.34

Timeline

• 2018-09-15 SystemBC SOCKS5 proxy/loader malware first advertised on Russian-speaking underground forums as commodity anonymization service.
• 2019-07-31 Proofpoint publishes foundational research 'SystemBC is Christmas in July,' documenting distribution via Fallout and RIG exploit kits.
• 2020-12-16 Sophos publishes first broad analysis linking SystemBC to Ryuk, Conti, and Egregor ransomware intrusions as a common post-exploitation component.
• 2021-09-22 CISA advisory AA21-265A on Conti ransomware explicitly names SystemBC as observed in affiliate toolkits.
• 2025-10-08 First confirmed victim posted to The Gentlemen's Tor leak site (a North American logistics firm).
• 2025-12-02 The Gentlemen advertised as affiliate-only RaaS program on RAMP and XSS forums; affiliates receive 80% revenue split.
• 2026-01-20 Updated SystemBC variant (internal version 3.3.2) observed using TCP 4044 and 4444 in addition to historical 4001, with added traffic obfuscation layer.
• 2026-02-18 Two large European manufacturers hit within 72 hours; both showed SystemBC beacons from domain controllers weeks prior to encryption event.
• 2026-04-17 Black Lotus Labs (Lumen) publishes telemetry showing 1,570+ simultaneously active SystemBC nodes serving as proxy backbone for The Gentlemen.
• 2026-04-18 BleepingComputer amplifies the research, attributing the SystemBC backbone primarily to The Gentlemen RaaS affiliate operations.
• 2026-04-20 Threadlinqs Intelligence publishes TL-2026-0399 with full IOC set, MITRE mapping, and multi-platform detection coverage.
• 2026-05-29 As of 2026-05-29, The Gentlemen RaaS and its SystemBC SOCKS5 botnet remain a live, escalating threat — ~332 published victims in the first five months of 2026 make it the second-most prolific ransomware op, corroborated by Check Point, Group-IB and The Hacker News. A May 4 backend leak (via 4VPS) did not stop them; the admin announced infra/locker upgrades and continued operating under the same brand with no takedown or arrests.

Sources cited

• CISA — #StopRansomware: Conti Ransomware (historical SystemBC usage) CISA · Government advisory · 2021-09-22
• SystemBC RAT Proxy Infrastructure Analysis blog.lumen.com · Research · 2026-04-17
• Proofpoint — SystemBC is Christmas in July: SOCKS5 Malware and Exploit Kits Proofpoint · Research · 2019-07-31
• Sophos — SystemBC malware used in ransomware attacks Sophos · Vendor report · 2020-12-16
• MITRE ATT&CK — Software: SystemBC (S0603) MITRE · Research · 2024-10-15
• Trellix — SystemBC Anonymization and SOCKS5 Proxy trellix.com · Research · 2023-08-09
• Recorded Future — SystemBC as Service for Ransomware Operators Recorded Future · Research · 2024-02-13
• The Gentlemen Ransomware Leverages SystemBC Proxy Botnet of 1,570+ Corporate Hosts BleepingComputer · News · 2026-04-18

Related threats

• The Gentlemen RaaS (Storm-2697) — Multi-Platform Ransomware-as-a-Service with BYOVD Defense Evasion and Self-Propagating Go Encryptor
• LockBit 5.0 Ransomware Extortion Claim Against US Bank (U.S. Bancorp)
• Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation
• Payload Ransomware Targeting Windows and VMware ESXi with Babuk-Derived Curve25519/ChaCha20 Encryption

More from The Gentlemen

• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• 2026 Dark Web Threat Trends: Infostealer Credential Markets, Ransomware Splintering, Deepfake KYC Bypass (JINKUSU CAM), Telegram Resilience, SaaS/Identity Breaches
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318

Previous and next in malware

• macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections Previous report
• NGate Android Malware — HandyPay-Trojanized NFC Relay Variant Targets Brazilian Cardholders via Fake Rio de Prêmios Lottery and Counterfeit Google Play Lures Next report