Loading story…
Sophos reported that SystemBC, a backdoor and proxy remote-access trojan first seen in 2019, has been used in ransomware intrusions tied to Ryuk and Egregor operators. In the investigated cases, attackers deployed the malware after obtaining administrative access and moving laterally through victim networks, using it to maintain persistence and deliver follow-on payloads. SystemBC can execute commands, scripts, shellcode, executables, and DLLs directly on compromised Windows systems, giving intruders a flexible post-compromise foothold.
Researchers said newer SystemBC variants have evolved from simple SOCKS5-style proxying to concealed command-and-control over Tor as well as raw TCP, helping attackers hide their infrastructure during hands-off operations. Sophos observed hundreds of attempted deployments worldwide and assessed that ransomware-as-a-service affiliates are using SystemBC as a shared utility alongside Cobalt Strike and loaders including Buer Loader, Bazar, Zloader, and Qbot. The report also noted an evasion feature in which the malware avoids creating a service if Emsisoft process a2guard.exe is present.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos publicly released research describing how ransomware operators were using SystemBC as an off-the-shelf Tor-enabled backdoor and persistence mechanism. The report documented its role in automated payload delivery and hands-off persistence across compromised networks.
In recent intrusions investigated by Sophos, attackers linked to Ryuk and Egregor operations deployed SystemBC after obtaining administrative access and moving laterally in victim networks. Sophos observed hundreds of attempted deployments worldwide and assessed that ransomware affiliates were using SystemBC alongside tools such as Cobalt Strike, Buer Loader, Bazar, Zloader, and Qbot.
Newer SystemBC samples added concealed command-and-control over the Tor network, expanding beyond raw TCP and earlier proxy-focused behavior. The malware also supported persistence and execution of commands, scripts, shellcode, executables, and DLLs on infected Windows systems.
Sophos reported that SystemBC, a backdoor/proxy RAT later used in ransomware intrusions, was first seen in 2019. Early variants functioned primarily as a SOCKS5-style proxy before later evolving.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky researchers reported that the **DroxiDat** malware operation was being used to infect Windows systems and deploy **SystemBC**, a proxy and backdoor trojan commonly associated with follow-on criminal activity. The campaign relied on malicious delivery chains that installed DroxiDat as an initial payload, after which it fetched additional components and established persistence on compromised hosts, giving operators a foothold for further malware deployment and covert network access. The reporting linked DroxiDat and SystemBC as part of a broader financially motivated intrusion ecosystem in which lightweight loaders and proxy malware are used to prepare victims for later-stage attacks. **SystemBC** enabled attackers to tunnel traffic, evade detection, and maintain command-and-control communications, increasing the value of infected machines for credential theft, malware staging, or potential ransomware operations.
Jul 12, 2026
Silent Push reported that the long-running **SystemBC** (aka **Coroxy** / **DroxiDat**) malware family has expanded into a botnet of **more than 10,000 unique infected IPs** globally. SystemBC primarily functions as a **SOCKS5 proxy** and **backdoor**, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to **ransomware-adjacent activity** dating back to 2019. The research indicates infections are concentrated in the **United States** (with additional hotspots including **Germany, France, Singapore, and India**) and includes compromises in **sensitive infrastructure**, such as IPs hosting government websites in **Burkina Faso** and **Vietnam**. Silent Push observed SystemBC infrastructure using **abuse-tolerant/bulletproof hosting** (including `bthoster[.]com` and **AS213790 / BTCloud**) and identified a **previously undocumented Perl-based variant**, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s **Operation Endgame** disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Jun 29, 2026
Researchers at InfoGuard identified a new Python-based backdoor, **ViperTunnel**, inside UK and US business networks, where it appears to provide persistent access that can later be sold or handed off to ransomware operators including **RansomHub**. The malware was uncovered during incident response to a **DragonForce** ransomware attack and is frequently seen after **FAKEUPDATES** (`SocGholish`) infections. Reporting also says ViperTunnel is often used alongside the **ShadowCoil** credential stealer, strengthening its role in broader intrusion chains that move from initial compromise to credential theft and eventual ransomware deployment. ViperTunnel disguises itself as a DLL but is actually a heavily obfuscated Python script that abuses Python's `sitecustomize.py` auto-loading mechanism for execution and persistence, including via suspicious Windows scheduled tasks. It establishes a **SOCKS5** proxy over port `443` to blend malicious traffic with normal web activity, while layered obfuscation and encryption hinder analysis. InfoGuard said the malware has evolved from error-filled early builds into a more modular framework and assessed it is likely linked to **UNC2165**, a cluster associated with **EvilCorp**; researchers also found Linux anti-debugging artifacts, including a `TracerPid` check, indicating the operators may be preparing a future cross-platform version targeting Linux systems.
Jun 29, 2026