Loading story…
Kaspersky researchers reported that the DroxiDat malware operation was being used to infect Windows systems and deploy SystemBC, a proxy and backdoor trojan commonly associated with follow-on criminal activity. The campaign relied on malicious delivery chains that installed DroxiDat as an initial payload, after which it fetched additional components and established persistence on compromised hosts, giving operators a foothold for further malware deployment and covert network access.
The reporting linked DroxiDat and SystemBC as part of a broader financially motivated intrusion ecosystem in which lightweight loaders and proxy malware are used to prepare victims for later-stage attacks. SystemBC enabled attackers to tunnel traffic, evade detection, and maintain command-and-control communications, increasing the value of infected machines for credential theft, malware staging, or potential ransomware operations.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report focused on the DroxiDat malware and the SystemBC malware family. No additional incident-specific events are provided in the reference content.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **SystemBC** evolved from a Windows SOCKS5 backconnect proxy delivered through **RIG** and **Fallout** exploit kits into a broader **malware-as-a-service** platform used by multiple cybercrime groups. Early campaigns tied the malware to Danabot and AZORult delivery, with the implant tunneling command-and-control traffic and obscuring follow-on activity through infected hosts. Technical analysis showed SystemBC used encrypted configuration data, RC4-protected communications, and support for `.bit` domain resolution, while underground advertising indicated it was being sold as a dedicated proxy service for other operators. Later reporting linked SystemBC customers to **TrickBot, QBot, and IcedID** activity and described a TOR-based sales and build system that allegedly generated more than **$100,000** in malware build revenue. Investigators said they identified infrastructure behind the service, recovered customer build data and panel components, and observed some deployments tasking bots to fetch **Cobalt Strike** payloads. A newer **PowerShell** variant, `socks5.ps1`, embedded command-and-control details, registered infected hosts with host metadata, and launched PowerShell jobs to proxy traffic, reinforcing SystemBC's role as a post-compromise access layer increasingly associated with enterprise ransomware operations.
Aug 15, 2026
Sophos reported that **SystemBC**, a backdoor and proxy remote-access trojan first seen in 2019, has been used in ransomware intrusions tied to **Ryuk** and **Egregor** operators. In the investigated cases, attackers deployed the malware after obtaining administrative access and moving laterally through victim networks, using it to maintain persistence and deliver follow-on payloads. SystemBC can execute commands, scripts, shellcode, executables, and DLLs directly on compromised Windows systems, giving intruders a flexible post-compromise foothold. Researchers said newer SystemBC variants have evolved from simple SOCKS5-style proxying to concealed command-and-control over **Tor** as well as raw TCP, helping attackers hide their infrastructure during hands-off operations. Sophos observed hundreds of attempted deployments worldwide and assessed that ransomware-as-a-service affiliates are using SystemBC as a shared utility alongside **Cobalt Strike** and loaders including **Buer Loader**, **Bazar**, **Zloader**, and **Qbot**. The report also noted an evasion feature in which the malware avoids creating a service if **Emsisoft** process `a2guard.exe` is present.
Jun 30, 2026
Silent Push reported that the long-running **SystemBC** (aka **Coroxy** / **DroxiDat**) malware family has expanded into a botnet of **more than 10,000 unique infected IPs** globally. SystemBC primarily functions as a **SOCKS5 proxy** and **backdoor**, enabling threat actors to relay command-and-control and other malicious traffic through victim systems to obscure attribution and maintain persistent access; some variants have also been linked to **ransomware-adjacent activity** dating back to 2019. The research indicates infections are concentrated in the **United States** (with additional hotspots including **Germany, France, Singapore, and India**) and includes compromises in **sensitive infrastructure**, such as IPs hosting government websites in **Burkina Faso** and **Vietnam**. Silent Push observed SystemBC infrastructure using **abuse-tolerant/bulletproof hosting** (including `bthoster[.]com` and **AS213790 / BTCloud**) and identified a **previously undocumented Perl-based variant**, suggesting ongoing development. Reporting also notes the botnet’s resilience following Europol’s **Operation Endgame** disruption efforts, with indications that operators have adapted their infrastructure and targeting to sustain long-lived infections.
Jun 29, 2026