# The Gentlemen Ransomware Operationalizes SystemBC SOCKS5 Botnet of 1,570+ Corporate Hosts for Double-Extortion Operations

> The Gentlemen ransomware group has weaponized the SystemBC proxy malware botnet — commanding more than 1,570 compromised corporate hosts as a distributed SOCKS5 anonymization layer for ransomware intrusions. The fusion of a mature loader/proxy family (SystemBC) with an active double-extortion RaaS operation collapses C2 traffic into trusted enterprise IP space, defeats geolocation and reputation controls, and provides ransomware affiliates with a low-cost, high-resilience staging network for reconnaissance, data theft, and payload delivery.

- **Published:** 2026-04-20T12:00:00Z
- **Last reviewed:** 2026-04-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0399
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-gentlemen-systembc-botnet-tl-2026-0399.webp?v=4952027f (Threadlinqs threat intel: The Gentlemen SystemBC 1,570+ Hosts: Detection & IOCs (TL-2026-0399) — High severity, 32 IOCs, 9 detection rules.)
- **ID:** TL-2026-0399
- **Severity:** HIGH (CVSS 8.5)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen (Russia)
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

The Gentlemen is a ransomware-as-a-service (RaaS) operation that surfaced in late 2025 with double-extortion attacks against manufacturing, logistics, legal, and healthcare verticals across North America and Western Europe. Independent research published in April 2026 by BleepingComputer and Lumen's Black Lotus Labs documents the group's operational integration with SystemBC — a malware family first sold on Russian-speaking underground forums in 2018–2019 as a generic SOCKS5 proxy and loader. Historically, SystemBC was bundled with Conti, Ryuk, Royal, Hive, and Egregor intrusions as a tertiary C2 relay; the 2026 campaign represents the first publicly disclosed fusion in which the proxy botnet itself is treated as primary operational infrastructure for a single ransomware brand.

Black Lotus Labs' April 2026 telemetry identifies a persistent backbone of more than 1,570 simultaneously-active SystemBC nodes, the vast majority of which are compromised corporate hosts (Windows servers, workstations, and Linux systems running legacy web applications). Affiliates of The Gentlemen route reconnaissance scans, Cobalt Strike beacons, Rclone exfiltration, and ransomware payload stagers through these nodes, causing malicious traffic to originate from the trusted ASN ranges of victim peers. The botnet is tiered: an outer ring of short-lived residential proxies absorbs scanning and credential-testing traffic, while a long-lived inner ring of compromised corporate hosts is reserved for hands-on-keyboard intrusions.

Initial access vectors observed in The Gentlemen intrusions include opportunistic exploitation of unpatched perimeter appliances (Fortinet FortiOS, Ivanti Connect Secure, Citrix NetScaler), phishing delivery of SocGholish and GootLoader frameworks that drop SystemBC as second-stage, and purchase of network access from initial access brokers. Once footholds are established, operators deploy a customized SystemBC variant (internal version string 3.3.2) that communicates with a hard-coded C2 list over a proprietary binary protocol on TCP ports 4001, 4044, and 4444, and establishes SOCKS5 listeners that the ransomware tooling proxies through. Post-compromise tooling includes Cobalt Strike 4.9, Sliver, Impacket's secretsdump.py, Mimikatz, AnyDesk/ScreenConnect for persistence, and Rclone for data staging to Mega.nz and BackBlaze B2 buckets before the ransomware payload executes.

The ransomware payload itself is a Go-based encryptor branded as 'Gentlemen-Locker' that uses ChaCha20 for file encryption with per-file keys protected by an X25519 hybrid scheme, appends the extension `.gntlm`, and drops a ransom note (`HOW-TO-DECRYPT-GENTLEMEN.txt`) containing a victim-unique Tor .onion negotiation portal. Leak-site data from the group's Tor dark-web portal confirms at least 47 named victims between December 2025 and April 2026, with initial ransom demands ranging from USD 480,000 to USD 9.2 million. The fusion of botnet proxy infrastructure with the ransomware brand dramatically reduces affiliate operating costs: Lumen estimates that the SystemBC backbone saves affiliates approximately USD 200 per hour in residential-proxy rental fees while providing significantly higher trust scores for egress traffic.

Defenders should treat any host beaconing to the SystemBC IOC list as a pre-ransomware indicator and trigger containment playbooks rather than routine cleanup. Network detection should focus on the distinctive SystemBC protocol handshake (little-endian length-prefixed binary frames, sub-200-byte initial registration), anomalous outbound SOCKS5 listeners on corporate assets, and process-genealogy signatures where RunDLL32, WerFault, or svchost spawn children communicating to high ports on sparse-reputation IPs. EDR should alert on the combination of Rclone execution, LSASS access by non-SYSTEM processes, and Volume Shadow Copy deletion within a 30-minute window.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1055 Process Injection
- T1548 Abuse Elevation Control Mechanism
- T1218 System Binary Proxy Execution
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1482 Domain Trust Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1090 Proxy
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SystemBC Loader Execution via rundll32 — Exploitation Phase** (`TL-2026-0399-SPL-001`)

Detects rundll32.exe executing sysbc.dll (or any DLL under C:\ProgramData\Microsoft\Network\) with the 'Start' export. This is the canonical SystemBC loader invocation observed across The Gentlemen ransomware intrusions documented by Black Lotus Labs (Lumen) and BleepingComputer in April 2026. Fires on the initial-access to foothold transition.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1218.011, T1105
- **Data sources:** sysmon, windows_security, edr_process_events, microsoft_defender_xdr
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\rundll32.exe" (CommandLine="*sysbc.dll*" OR CommandLine="*\\ProgramData\\Microsoft\\Network\\*" OR CommandLine="*,Start*") earliest=-24h@h
| eval ioc_path=if(match(CommandLine, "(?i)ProgramData\\\\Microsoft\\\\Network"), "ioc_path_match", "no")
| eval ioc_file=if(match(CommandLine, "(?i)sysbc\\.dll"), "ioc_file_match", "no")
| eval ioc_export=if(match(CommandLine, "(?i),\\s*Start"), "ioc_export_match", "no")
| where ioc_file="ioc_file_match" OR (ioc_path="ioc_path_match" AND ioc_export="ioc_export_match")
| stats min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmdlines values(ParentImage) as parent_images count by host User Image
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen host User Image parent_images cmdlines count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_any ("sysbc.dll", @"ProgramData\Microsoft\Network")
   or (ProcessCommandLine has @"ProgramData\Microsoft\Network" and ProcessCommandLine matches regex @",\s*Start\b")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| summarize first_seen=min(Timestamp), last_seen=max(Timestamp), cmdlines=make_set(ProcessCommandLine, 10), parents=make_set(InitiatingProcessFileName, 10), hits=count() by DeviceName, AccountName
```

### Sigma

```yaml
title: SystemBC Loader Execution via rundll32 (The Gentlemen — TL-2026-0399)
id: 2c3f0399-1001-4a01-9b2f-tl20260399101
status: experimental
description: Detects rundll32.exe invocations whose command line matches the SystemBC drop path (C:\ProgramData\Microsoft\Network\) and/or the IOC filename sysbc.dll with the 'Start' export — the canonical The Gentlemen / SystemBC loader pattern.
references:
    - https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-leverages-systembc-proxy-botnet-of-1570-corporate-hosts/
    - https://blog.lumen.com/systembc-rat-wants-you-to-buy-it-now/
    - https://attack.mitre.org/software/S0603/
author: Threadlinqs Team
date: 2026/04/20
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218.011
    - attack.t1105
    - threadlinqs.TL-2026-0399
logsource:
    product: windows
    category: process_creation
detection:
    selection_image:
        Image|endswith: '\rundll32.exe'
    selection_sysbc:
        CommandLine|contains: 'sysbc.dll'
    selection_path_and_export:
        CommandLine|contains|all:
            - 'ProgramData\Microsoft\Network\'
            - ',Start'
    condition: selection_image and (selection_sysbc or selection_path_and_export)
falsepositives:
    - None expected — sysbc.dll is a SystemBC IOC filename and ProgramData\Microsoft\Network is not a standard Microsoft-written path.
level: high

```

**Known false positives:**

- None expected for the sysbc.dll filename. Rare admin/tooling that legitimately drops helper DLLs under C:\ProgramData\Microsoft\Network\ — verify digital signature and image hash before excluding.

**Tuning notes:** Baseline rundll32 parent processes in the environment (explorer.exe, svchost.exe, wermgr.exe). Exclude signed Microsoft DLLs by adding an allowlist on SHA256/Signer fields. If environment uses ProgramData for legitimate DLLs, restrict the path-based branch to require the ',Start' export.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SystemBC Loader Drop and Linux Cron Persistence — Exploitation Phase (locked: unlock with TL Creds)
- SystemBC Run-Key Persistence and LSASS Credential Access — Post-Exploitation Phase (locked: unlock with TL Creds)
- SystemBC Domain Resolution and Rclone Cloud Exfiltration — C2 and Exfiltration Phase (locked: unlock with TL Creds)
- Gentlemen Ransom Note Drop and .gntlm Extension Rename — Exploitation Terminal Marker (locked: unlock with TL Creds)
- SystemBC Persistence Artifacts (Run Key, Service, Linux Cron) — Post-Exploitation Phase (locked: unlock with TL Creds)
- SystemBC Anomalous Outbound Tunnel from Proxy-Genealogy Process — Lateral Movement Phase (locked: unlock with TL Creds)
- Shadow Copy Deletion Pre-Ransomware Anti-Recovery — Post-Exploitation Phase (locked: unlock with TL Creds)
- SystemBC SOCKS5 Beacon to IOC Ports and Infrastructure — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `185.25.51[.]173`
- Domain: `systembc-panel[.]su`
- File hash: `8f6b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Gentlemen Ransomware Leverages SystemBC Proxy Botnet of 1,570+ Corporate Hosts](https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-leverages-systembc-proxy-botnet-of-1570-corporate-hosts/)
- [SystemBC RAT Proxy Infrastructure Analysis](https://blog.lumen.com/systembc-rat-wants-you-to-buy-it-now/)
- [Proofpoint — SystemBC is Christmas in July: SOCKS5 Malware and Exploit Kits](https://www.proofpoint.com/us/blog/threat-insight/systembc-christmas-july-socks5-malware-and-exploit-kits)
- [Sophos — SystemBC malware used in ransomware attacks](https://news.sophos.com/en-us/2020/12/16/systembc/)
- [CISA — #StopRansomware: Conti Ransomware (historical SystemBC usage)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-265a)
- [MITRE ATT&CK — Software: SystemBC (S0603)](https://attack.mitre.org/software/S0603/)
- [Trellix — SystemBC Anonymization and SOCKS5 Proxy](https://www.trellix.com/about/newsroom/stories/research/systembc-malware/)
- [Recorded Future — SystemBC as Service for Ransomware Operators](https://www.recordedfuture.com/blog/systembc-malware-analysis)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0399