# SystemBC (Coroxy) Malware: Tor-Based SOCKS5 Proxy Backdoor Enabling Ransomware Persistence and C2 Obfuscation

> SystemBC is a Windows backdoor malware actively deployed by six major ransomware families (Ryuk, Egregor, Conti, BlackBasta, Play, Rhysida, Cactus) to establish persistent remote access and hide command-and-control traffic using embedded Tor gateway infrastructure. The malware converts compromised systems into SOCKS5 proxies, enabling attackers to route external traffic through internal networks and deploy secondary payloads including post-exploitation frameworks and encryption malware.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1005
- **ID:** TL-2026-1005
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Conti
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SystemBC, also known as Coroxy or DroxiDat, is a sophisticated Windows remote access trojan (RAT) that serves as a critical tool in the ransomware supply chain. First discovered in 2019 and actively deployed since 2020, SystemBC provides ransomware operators with reliable persistent backdoor access and C2 infrastructure obfuscation capabilities. The malware utilizes a multi-stage deployment process, typically delivered via email-based phishing campaigns or loader malware (Buer, Qbot, Zloader, Bazar, Emotet, Matanbuchus 3.0). Upon execution, SystemBC establishes persistence through dual mechanisms: Windows registry Run keys and scheduled tasks with random naming patterns. The malware communicates with command-and-control servers using RC4-encrypted custom binary protocols, with modern variants leveraging embedded Tor libraries to route communications through the Tor network, making detection and attribution significantly more difficult. A key feature is its ability to execute payloads directly in memory without writing to disk, bypassing many disk-based detection systems and forensic analysis. SystemBC converts infected systems into SOCKS5 proxy servers, allowing remote attackers to tunnel traffic through internal networks and access resources that would otherwise be unreachable from external networks. This proxy functionality is particularly valuable for ransomware operations, enabling lateral movement through network segments and deployment of attack frameworks like Cobalt Strike. The malware's system reconnaissance capabilities collect Windows usernames, build numbers, device names, architecture information, and volume serial numbers—intelligence used for targeting decisions and attack planning. As of February 2026, security researchers have identified over 10,000 actively infected systems worldwide, with the majority hosted on bullet-proof hosting providers. The infrastructure targeting pattern suggests SystemBC operators deliberately focus on hosting providers and critical infrastructure, likely to establish a supply of proxy infrastructure that can be rented or sold to other criminal groups. The malware has demonstrated continuous evolution, with new variants discovered regularly including PowerShell-based versions and previously undocumented Perl variants targeting Linux systems.

## MITRE ATT&CK

- T1087 Account Discovery
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1001 Data Obfuscation
- T1140 Deobfuscate/Decode Files or Information
- T1480 Execution Guardrails
- T1564 Hide Artifacts
- T1620 Reflective Code Loading
- T1678 Delay Execution
- T1057 Process Discovery
- T1082 System Information Discovery
- T1124 System Time Discovery
- T1071 Application Layer Protocol
- T1095 Non-Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1090 Proxy
- T1053 Scheduled Task/Job

## Sources

- [SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows](https://www.picussecurity.com/resource/blog/systembc-malware-how-the-coroxy-proxy-backdoor-targets-windows)
- [Silent Push: SystemBC Identifies More Than 10,000 Infected IPs](https://www.silentpush.com/blog/systembc/)
- [Bitsight: SystemBC - The Multipurpose Proxy Bot Still Breathes](https://www.bitsight.com/blog/systembc-multipurpose-proxy-bot-still-breathes)
- [Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor - Sophos](https://www.sophos.com/en-us/blog/systembc)
- [Proofpoint: SystemBC - Christmas in July with SOCKS5 Malware and Exploit Kits](https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits)
- [Threat Thursday: SystemBC – a RAT in the Pipeline - BlackBerry](https://blogs.blackberry.com/en/2021/06/threat-thursday-systembc-a-rat-in-the-pipeline)
- [SophosLabs IOCs Repository - SystemBC](https://github.com/sophoslabs/IoCs/blob/master/Malware-SystemBC.csv)
- [MITRE ATT&CK: SystemBC (S9001)](https://attack.mitre.org/software/S9001/)
- [Kroll: Inside The SYSTEMBC Malware Server](https://www.kroll.com/en/publications/cyber/inside-the-systembc-malware-server)
- [Trend Micro: Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal](https://www.trendmicro.com/en_us/research/25/b/black-basta-cactus-ransomware-backconnect.html)
- [Kaspersky Securelist: Focus on DroxiDat/SystemBC](https://securelist.com/focus-on-droxidat-systembc/110302/)
- [WithSecure Labs: Prelude to Ransomware: SystemBC](https://labs.withsecure.com/publications/prelude-to-ransomware-systembc)
- [Black Basta-Linked Attackers Target Users with SystemBC Malware](https://thehackernews.com/2024/08/black-basta-linked-attackers-targets.html)
- [CISA #StopRansomware: Black Basta Advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)
- [Huntress: A New RAT and a Hands-on-Keyboard Intrusion](https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1005