Loading story…
Silent Push reported that the long-running SystemBC (aka Coroxy / DroxiDat) malware family has expanded into a botnet of more than 10,000 unique infected IPs globally. SystemBC primarily functions as a SOCKS5 proxy and backdoor, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to ransomware-adjacent activity dating back to 2019.
The research indicates infections are concentrated in the United States (with additional hotspots including Germany, France, Singapore, and India) and includes compromises in sensitive infrastructure, such as IPs hosting government websites in Burkina Faso and Vietnam. Silent Push observed SystemBC infrastructure using abuse-tolerant/bulletproof hosting (including bthoster[.]com and AS213790 / BTCloud) and identified a previously undocumented Perl-based variant, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s Operation Endgame disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Silent Push reported signals, including VirusTotal comments, suggesting some SystemBC-infected IPs were involved in WordPress exploitation activity, indicating the proxy network may be used to target WordPress sites.
Researchers reported a previously undocumented Linux-focused SystemBC variant written in Perl that had no VirusTotal detections at the time it was observed. They also described associated ELF droppers, including SafeObject and StringHash, used to deploy embedded payloads.
The investigation found SystemBC infections on infrastructure hosting government websites in Vietnam and Burkina Faso, indicating the botnet had reached sensitive hosting environments.
Silent Push identified 10,340 unique victim IP addresses tied to SystemBC worldwide, showing the botnet remained large and active despite prior law-enforcement disruption. The highest concentrations were observed in the United States, followed by countries including Germany, France, and Singapore.
During 2025, Silent Push created and used a tracking fingerprint for SystemBC that enabled researchers to identify victim IPs and measure infection persistence and geographic distribution.
In May 2024, Europol's Operation Endgame disrupted infrastructure associated with SystemBC, but later reporting indicates the botnet remained active afterward.
SystemBC, also known as Coroxy or DroxiDat, was first publicly documented in 2019 as a multi-platform malware family used for proxying and backdoor access on compromised systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcesilentpush.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New threat research described two distinct botnet operations expanding through mass compromise. Flare reported a previously undocumented Linux botnet it dubbed **SSHStalker**, observed via an SSH honeypot and characterized by *IRC-based* command-and-control with multiple bot variants (including legacy families such as **Tsunami** and **Keiten**), automated scanning and staging (including a Golang scanner masquerading as `nmap` behavior and a compile-and-run workflow), and noisy but effective persistence via `cron` jobs that can re-establish the bot within roughly a minute if not fully removed. The tooling also included log-tampering artifacts (e.g., `utmp/wtmp/lastlog` manipulation) and a “back-catalog” of older Linux 2.6-era exploits, suggesting the operator is targeting long-tail, poorly maintained infrastructure; Flare noted playbook similarities to **Outlaw/Maxlas**-style operations but did not claim definitive attribution. Separately, reporting on a Silent Push analysis described a large **SystemBC** (aka **Coroxy/DroxiDat**) botnet comprising **10,000+** infected IPs globally, with notable concentrations in the US and additional presence across Europe and Asia. SystemBC is described as **SOCKS5 proxy malware** commonly used by threat actors to mask downstream activity and historically associated with enabling ransomware deployment; the report highlighted infections linked to **government-related domains** based on passive DNS observations, indicating potential exposure of sensitive environments even when immediate follow-on payloads were not directly observed. A third article provided general technical background on how internet-wide scanners (e.g., Shodan/Censys-style platforms) perform active service identification and banner grabbing; it is contextual but does not report on either botnet operation specifically.
Jun 29, 2026
Sophos reported that **SystemBC**, a backdoor and proxy remote-access trojan first seen in 2019, has been used in ransomware intrusions tied to **Ryuk** and **Egregor** operators. In the investigated cases, attackers deployed the malware after obtaining administrative access and moving laterally through victim networks, using it to maintain persistence and deliver follow-on payloads. SystemBC can execute commands, scripts, shellcode, executables, and DLLs directly on compromised Windows systems, giving intruders a flexible post-compromise foothold. Researchers said newer SystemBC variants have evolved from simple SOCKS5-style proxying to concealed command-and-control over **Tor** as well as raw TCP, helping attackers hide their infrastructure during hands-off operations. Sophos observed hundreds of attempted deployments worldwide and assessed that ransomware-as-a-service affiliates are using SystemBC as a shared utility alongside **Cobalt Strike** and loaders including **Buer Loader**, **Bazar**, **Zloader**, and **Qbot**. The report also noted an evasion feature in which the malware avoids creating a service if **Emsisoft** process `a2guard.exe` is present.
Jun 30, 2026
Kaspersky researchers reported that the **DroxiDat** malware operation was being used to infect Windows systems and deploy **SystemBC**, a proxy and backdoor trojan commonly associated with follow-on criminal activity. The campaign relied on malicious delivery chains that installed DroxiDat as an initial payload, after which it fetched additional components and established persistence on compromised hosts, giving operators a foothold for further malware deployment and covert network access. The reporting linked DroxiDat and SystemBC as part of a broader financially motivated intrusion ecosystem in which lightweight loaders and proxy malware are used to prepare victims for later-stage attacks. **SystemBC** enabled attackers to tunnel traffic, evade detection, and maintain command-and-control communications, increasing the value of infected machines for credential theft, malware staging, or potential ransomware operations.
Jul 12, 2026