Loading story…
Kaspersky researchers reported that the DroxiDat malware operation was being used to infect Windows systems and deploy SystemBC, a proxy and backdoor trojan commonly associated with follow-on criminal activity. The campaign relied on malicious delivery chains that installed DroxiDat as an initial payload, after which it fetched additional components and established persistence on compromised hosts, giving operators a foothold for further malware deployment and covert network access.
The reporting linked DroxiDat and SystemBC as part of a broader financially motivated intrusion ecosystem in which lightweight loaders and proxy malware are used to prepare victims for later-stage attacks. SystemBC enabled attackers to tunnel traffic, evade detection, and maintain command-and-control communications, increasing the value of infected machines for credential theft, malware staging, or potential ransomware operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report focused on the DroxiDat malware and the SystemBC malware family. No additional incident-specific events are provided in the reference content.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that **SystemBC**, a backdoor and proxy remote-access trojan first seen in 2019, has been used in ransomware intrusions tied to **Ryuk** and **Egregor** operators. In the investigated cases, attackers deployed the malware after obtaining administrative access and moving laterally through victim networks, using it to maintain persistence and deliver follow-on payloads. SystemBC can execute commands, scripts, shellcode, executables, and DLLs directly on compromised Windows systems, giving intruders a flexible post-compromise foothold. Researchers said newer SystemBC variants have evolved from simple SOCKS5-style proxying to concealed command-and-control over **Tor** as well as raw TCP, helping attackers hide their infrastructure during hands-off operations. Sophos observed hundreds of attempted deployments worldwide and assessed that ransomware-as-a-service affiliates are using SystemBC as a shared utility alongside **Cobalt Strike** and loaders including **Buer Loader**, **Bazar**, **Zloader**, and **Qbot**. The report also noted an evasion feature in which the malware avoids creating a service if **Emsisoft** process `a2guard.exe` is present.
Jun 30, 2026
Silent Push reported that the long-running **SystemBC** (aka **Coroxy** / **DroxiDat**) malware family has expanded into a botnet of **more than 10,000 unique infected IPs** globally. SystemBC primarily functions as a **SOCKS5 proxy** and **backdoor**, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to **ransomware-adjacent activity** dating back to 2019. The research indicates infections are concentrated in the **United States** (with additional hotspots including **Germany, France, Singapore, and India**) and includes compromises in **sensitive infrastructure**, such as IPs hosting government websites in **Burkina Faso** and **Vietnam**. Silent Push observed SystemBC infrastructure using **abuse-tolerant/bulletproof hosting** (including `bthoster[.]com` and **AS213790 / BTCloud**) and identified a **previously undocumented Perl-based variant**, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s **Operation Endgame** disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Jun 29, 2026
Multiple active malware campaigns are delivering **remote access trojans (RATs)** using deceptive lures and multi-stage execution chains designed to evade endpoint defenses. Malwarebytes reported a campaign dubbed **DEAD#VAX** that distributes a file masquerading as a “PDF” but actually delivered as a **virtual hard disk (`.vhd`)** hosted via **IPFS**; when opened, Windows mounts the VHD and the victim is tricked into launching a **Windows Script File (`.wsf`)** that ultimately deploys **AsyncRAT**. The chain includes anti-analysis checks and **process injection** into Microsoft-signed binaries such as `RuntimeBroker.exe`, `OneDrive.exe`, `taskhostw.exe`, and `sihost.exe`, enabling hands-on-keyboard remote control while minimizing obvious on-disk artifacts. Separately, reporting described **DesckVB RAT v2.9**, a modular **.NET** RAT using an obfuscated **WSH JavaScript** stager followed by **PowerShell**-based anti-analysis checks and an in-memory (“fileless”) loader, emphasizing persistence and a plugin-based architecture for post-compromise capabilities. Another campaign distributes **ValleyRAT** disguised as a legitimate *LINE* installer, targeting **Chinese-speaking users**; it attempts to weaken defenses by using PowerShell to add broad **Windows Defender exclusions**, performs sandbox checks (e.g., mutex/file-locking behaviors), and uses advanced injection (reported as **PoolParty Variant 7** via Windows I/O completion ports) to hide within trusted processes while stealing credentials and maintaining C2 communications.
Jun 29, 2026