SystemBC (Coroxy / DroxiDat) Malware: Multi-Purpose SOCKS5/Tor Proxy Backdoor Enabling Ransomware Operations
SystemBC (Coroxy / DroxiDat) Malware (TL-2026-1227), also tracked as Coroxy, is a high-severity malware campaign, first published 2026-07-11. It is attributed to Periwinkle Tempest (Russia) with low confidence, affects Microsoft Windows, maps to 29 MITRE ATT&CK techniques (T1001, T1021, T1053), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-1227
- Threat ID
- TL-2026-1227
- Also known as
- Coroxy, DroxiDat, Backdoor:Win32/Coroxy.A
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- Periwinkle Tempest
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- critical infrastructure, energy, health, government administration, finance, manufacturing, retail, education
- Target regions
- North America, Europe, Africa, Global
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in SystemBC (Coroxy / DroxiDat) Malware
Malware and tooling: SystemBC (Windows), SystemBC - S9001, Cobalt Strike, mini-tor
SystemBC (aka Coroxy, DroxiDat) is a Windows-only backdoor/RAT sold as malware-as-a-service that converts infected hosts into SOCKS5 (and, in newer variants, Tor) proxies to tunnel other malware's C2 traffic and execute arbitrary commands, scripts, and binaries. It has been used as an access/tunneling component alongside numerous ransomware families including Ryuk, Egregor, Maze, MountLocker, Conti, Nokoyawa, BlackBasta, Play, ViceSociety, 8Base, and Rhysida.
How SystemBC (Coroxy / DroxiDat) Malware works
SystemBC is a commodity Windows backdoor first documented in 2018 that has evolved into a persistent "Swiss-army-knife" tool in the ransomware ecosystem. It is typically delivered via exploit kits (historically RIG, Fallout) or dropped by loader malware (Emotet, QBot/Qakbot, Buer Loader) after initial compromise, and by threat actors such as Wizard Spider (since 2020) and FIN7 (since 2022), as well as financially motivated intrusion sets tracked as Pistachio Tempest/FIN12.
Once deployed, SystemBC establishes persistence via a Registry Run key (commonly under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, value name "socks5") and/or a scheduled task with a randomly named `.job` file under `C:\Windows\Tasks\`. The malware copies itself into a randomly named subdirectory of `%ProgramData%` and re-registers the copy as a scheduled task invoked with a "start" argument. It performs anti-analysis checks, including skipping persistence installation when Emsisoft's `a2guard.exe` process is detected.
C2 communication begins with a 100-byte beacon: a 50-byte plaintext RC4 key followed by 50 bytes of RC4-encrypted host/user reconnaissance data (machine name, username, IP address, volume serial number). Configuration data is stored/obfuscated in memory using a 40-byte XOR key. The malware supports resolution of `.bit` pseudo-domains via alternate/custom DNS infrastructure (observed using OpenNIC resolvers such as ns1.vic.au.dns.opennic.glue and ns2.vic.au.dns.opennic.glue), and newer variants embed a mini-tor-based Tor client (using Windows BCrypt/CNG cryptographic APIs) to route C2 over the Tor network, hardcoding Tor directory authority IPs (193.23.244.244, 86.59.21.38, 199.58.81.140, 204.13.164.118) to bootstrap circuits without relying on the public Tor consensus fetch. The default C2 listener port is TCP/4001; the SOCKS5 proxy component is advertised on underground forums as supporting configurable ports and up to 40,000 concurrent proxied connections.
SystemBC operates as both a RAT and a loader: it can execute arbitrary EXE, DLL, shellcode, VBS, BAT, CMD, and PowerShell payloads pushed from its operator, including in-memory (reflective) execution to minimize disk artifacts. This lets ransomware affiliates use a single implant for discovery, credential/lateral-movement tooling delivery, and traffic tunneling that evades network-based detection (since ransomware C2/exfil traffic egresses through the compromised host's SOCKS5/Tor tunnel rather than a directly attributable ransomware C2 address).
A closely related lightweight variant tracked as DroxiDat (~8KB) was observed in March 2023 in an intrusion against a healthcare-sector target in southern Africa, functioning purely as a system profiler/lightweight SystemBC client that collected host information and staged a Cobalt Strike beacon from the same infrastructure cluster before the intrusion proceeded toward Nokoyawa ransomware deployment. That incident used a `C:\perflogs\` staging directory and C2 domains with power/energy-industry-themed naming (`powersupportplan[.]com`, `epowersoftware[.]com`), suggesting deliberate blending into critical-infrastructure/utility-sector network traffic; Kaspersky attributed the cluster to Pistachio Tempest/FIN12 with low confidence based on staging-directory reuse and shared Cobalt Strike license IDs across incidents.
SystemBC's persistent value to ransomware affiliates comes from decoupling proxy/tunneling infrastructure from the ransomware payload itself: defenders who block or attribute ransomware C2 domains do not automatically disrupt the SystemBC tunnel, and the SOCKS5/Tor layer can be reused across multiple ransomware deployments and affiliates purchasing the same malware-as-a-service kit.
MITRE ATT&CK techniques used in TL-2026-1227
command-and-control
Lateral Movement
Persistence
T1053 Scheduled Task/Job; T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1087.001 Local Account; T1124 System Time Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1106 Native API
Command and Control
T1071 Application Layer Protocol; T1071.004 DNS; T1090.003 Multi-hop Proxy; T1095 Non-Application Layer Protocol; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1564.003 Hidden Window; T1620 Reflective Code Loading; T1678 Delay Execution
Initial Access
Affected products and versions in SystemBC (Coroxy / DroxiDat) Malware
- Microsoft — Windows
Vulnerable versions: all supported Windows desktop and server versions
Remediation for SystemBC (Coroxy / DroxiDat) Malware
Immediate actions
- Block outbound TCP/4001 to unclassified external hosts and alert on it as a high-fidelity SystemBC indicator
- Block/monitor the embedded Tor directory authority IPs (193.23.244.244, 86.59.21.38, 199.58.81.140, 204.13.164.118) and general Tor egress from server subnets
- Hunt for and remove the HKCU\Software\Microsoft\Windows\CurrentVersion\Run "socks5" registry value across endpoints
- Enumerate scheduled tasks under C:\Windows\Tasks with randomly-named .job files and randomly-named executables under %ProgramData%
- Isolate any host exhibiting SOCKS5 proxy behavior or unexplained Tor client activity pending forensic triage
- Search for staging directories such as C:\perflogs\ containing unexpected executables (syscheck.exe, hos.exe, host.exe, svch.dll, svchoct.dll, clinic.exe)
Workarounds
- Restrict local administrator rights and PowerShell/script execution via application control to limit SystemBC's ability to execute pushed payloads
Longer-term hardening
- Deploy EDR with behavioral detection for reflective/in-memory PE loading and scheduled-task-based persistence
- Implement network egress filtering / DNS monitoring for .bit pseudo-TLD resolution and non-standard DNS resolver usage (e.g., OpenNIC)
- Harden against initial-access loaders (Emotet/Qakbot-class) that commonly precede SystemBC deployment
- Establish baseline monitoring for anomalous outbound connections on non-standard TCP ports from workstation subnets
- Correlate SystemBC detections with Cobalt Strike / ransomware precursor activity given its historical role as a ransomware access broker component
Timeline of SystemBC (Coroxy / DroxiDat) Malware
- SystemBC first documented in the wild, delivered as a payload by the RIG and Fallout exploit kits.
- SystemBC becomes an established 'Swiss-army-knife' tool sold on underground cybercrime forums as malware-as-a-service.
- Wizard Spider begins using SystemBC alongside Ryuk and later Conti ransomware operations for proxying and post-exploitation tooling delivery.
- SystemBC observed supporting Egregor and Maze ransomware intrusions as a Tor-based backdoor/proxy component (per Sophos reporting).
- Proofpoint publishes 'SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits,' documenting continued exploit-kit distribution.
- FIN7 begins incorporating SystemBC into its intrusion toolkit.
- DroxiDat (lightweight SystemBC variant) deployed against a healthcare-sector target in southern Africa, staging Cobalt Strike beacons from power/energy-themed C2 domains ahead of Nokoyawa ransomware deployment.
- Kaspersky (Securelist) publishes 'Focus on DroxiDat/SystemBC,' attributing the cluster to Pistachio Tempest/FIN12 with low confidence.
- RexorVc0 publishes 'The Swiss Knife - SystemBC | Coroxy,' a technical reverse-engineering deep dive on the RC4 beacon protocol and configuration format.
- SystemBC observed enabling access for MountLocker, BlackBasta, Play, ViceSociety, 8Base, and Rhysida ransomware operations.
- Picus Security publishes 'SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows,' summarizing the malware's persistence, C2, and Tor-tunneling evolution.
- Threat documented in the Threadlinqs Intelligence Platform based on Picus Security reporting and corroborating vendor/MITRE research.
Sources cited for SystemBC (Coroxy / DroxiDat) Malware
- SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows
- SystemBC, Software S9001
- Focus on DroxiDat/SystemBC
- SystemBC Malware: Analysis, Detection, Removal
- Hackers Use SystemBC Malware to Hide C2 Traffic and Maintain Persistent Access
- SystemBC (Malware Family)
- SystemBC Malware Turns Windows Machines Into SOCKS5 Proxies for Ransomware Attacks
- Backdoor:Win32/Coroxy.A threat description
- The Swiss Knife - SystemBC | Coroxy
- SystemBC
Threats related to SystemBC (Coroxy / DroxiDat) Malware
Detection coverage for TL-2026-1227
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1227 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.