SystemBCMalware
SystemBC is a malware family offered as a malware-as-a-service (MaaS) that is used to establish command and control and facilitate follow-on activity, including ransomware deployment. SystemBC executes a variety of tasks including setting up SOCKS5 proxies, maintaining persistence, ingesting malicious files, and handing C2 communication.From MITRE ATT&CK
Last reported 29 days ago, by Risky Business News7 reports
ATT&CK techniques
6 of 73 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“Besides Cobalt Strike’s capabilities to run the Beacon stagers on remote hosts, the attackers used Remote Desktop Protocol to move laterally.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“Masquerading - Match Legitimate Name or Location”
- T1053.005Scheduled Task
“…ware variants: one based on LockBit 3.0 and another analyzed by Group-IB as a ContiV3-based build with added features such as BYOVD, scheduled-task persistence, and expanded encryption customization.”
- T1055Process Injection
“This path has also been observed as a SpawnTo parameter in Cobalt Strike process injection configurations.”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“KongTuke spreads SystemBC: According to a new report, the KongTuke e-crime group is now spreading the SystemBC RAT via ClickFix lures.”
-
PikaBot: a Guide to its Deep Secrets and Operations“… the Operation Endgame to disrupt criminal services, notably through taking down key botnet infrastructures, including those of IcedID, SystemBC, PikaBot, SmokeLoader and BumbleBee.”
-
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs“The threat actor deployed multiple malware families, including SystemBC for proxy tunneling, and later Betruger backdoor for additional capabilities.”
-
Inside the Dragon: DragonForce Ransomware Group“…e ransomware group, which poses a severe threat with two variants—a LockBit fork and a customized Conti fork with advanced features and SystemBC malware.”
-
The untold story of incident response: A Christmas Miracle“…ugh occurred when Group-IB Threat Intelligence successfully located a command-and-control (C&C) server associated with a backdoor named SystemBC, which has previously been exploited to deploy ransomware.”
-
CUBA Ransomware Campaign Analysis“SystemBC”
-
Connecting the Bots“Another tool, which is becoming more and more popular among various ransomware operators – SystemBC.”
Indicators in its reports
named in the reports above- third-party[.]comin 1 report
- 104.194.9[.]227in 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.