Loading malware…
SystemBC is a Windows malware family best known as a SOCKS5 backconnect proxy and remote access tool that has evolved from a covert communications utility into a multifunctional malware-as-a-service platform used extensively in crimeware and ransomware operations. Early variants primarily provided TLS-encrypted proxying to relay malicious traffic and conceal operator activity, while later variants added command execution and payload delivery capabilities, including the ability to run scripts and additional executables or DLLs on compromised hosts. SystemBC is commonly used to maintain persistent access, tunnel RDP and other traffic into victim networks, and support hands-on-keyboard post-compromise activity.
SystemBC has been observed in enterprise intrusions associated with ransomware affiliates and broader big-game-hunting tradecraft, including incidents involving PLAY ransomware and other financially motivated actors. It has also appeared in long-running espionage-oriented intrusions, including activity attributed to Iranian operators targeting Middle Eastern critical infrastructure, where it was used alongside tunneling tools, web shells, credential theft tooling, and lateral movement utilities. In criminal ecosystems, SystemBC has been delivered by other malware families and access brokers, including BatLoader, Emotet, and Gootloader-derived intrusion chains, underscoring its role as a modular follow-on payload rather than a primary initial infection mechanism in many cases.
The malware is strongly associated with stealthy communications. Multiple reports describe its use of TLS to blend command-and-control and proxy traffic into normal encrypted network activity, sometimes over non-standard ports. PowerShell-based variants implement SOCKS-style proxying through background jobs and have been used to establish tunnels that expose internal systems to external operator access. Native variants have been observed creating scheduled tasks or autorun-based persistence and using hidden PowerShell execution or DLL sideloading-style loader chains to reduce visibility. Some samples are heavily packed, including with VMProtect and additional custom packing layers, reflecting a sustained emphasis on anti-analysis and defense evasion.
Operationally, SystemBC is most often used after initial compromise to provide persistence, covert access, and traffic forwarding for subsequent actions such as credential theft, lateral movement, remote administration, and ransomware staging. It has been used to proxy RDP into internal environments, support compromise of domain controllers and backup infrastructure, and facilitate broader post-exploitation workflows. Its prevalence across ransomware, loader, and intrusion-service ecosystems has made SystemBC a durable and widely recognized component of modern Windows intrusion chains.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In one intrusion, we observed the Black Basta operator exploiting the PrintNightmare vulnerability and dropping spider.dll as the payload.
The primary initial-access vector is exploitation of CVE-2024–55591, an authentication bypass in Fortinet FortiOS and FortiProxy with a CVSS score of 9.8. The vulnerability was disclosed in January 2025; proof-of-concept code circulated quickly, and mass exploitation of unpatched edge devices followed.
multiple ransomware groups, including initial access brokers with ties to Play ransomware operators, are also exploiting three vulnerabilities - CVE-2024-57727 - in remote monitoring and management tool SimpleHelp to conduct remote code execution at many U.S.-based entities
Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
Attackers leverage credential theft, lateral movement tools (Cobalt Strike, SystemBC), and social engineering (notably by UNC3944/Scattered Spider) to escalate privileges and deploy Linux-based ESXi encryptors.
We observed the execution of the ProxyLogon exploit. Previous research has observed this threat group leveraging ProxyLogon and ProxyShell vulnerabilities to gain initial access.
30 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
C:\windows\en-us\ClMgr.dll ... ClMgr.dll ... SystemBC | In this intrusion, this DarkLoadLibrary variant was used to load ‘ClMgr.dll’ which FortiGuard identified as a SystemBC agent.
We also expose how it historically used SystemBC to manage the proxies located in Ukraine to avoid blocklists that would launch the malspam campaigns.
We also expose how it historically used SystemBC to manage the proxies located in Ukraine to avoid blocklists that would launch the malspam campaigns.
Batloader can install different malware families, such as: Bumble Loader Cobalt Strike Qakbot Raccoon Stealer RedLine Stealer Smoke Loader System BC Ursnif (Bot) Vidar (Stealer) ZLoader
Proofpoint saw [TA577] involved in the distribution of payloads such as QakBot, IcedID, SystemBC as well as Cobalt Strike.
SystemBC has historically been a proxy bot that has been around for sale since at least April 2019... The malware itself is pretty simplistic, although effective, but has mostly evolved into both a backdoor and proxy bot since it was first released.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
This EXE file was made persistent on the infected host through a scheduled task.
The sequence ends with the execution of an obfuscated PowerShell script, which calls another PowerShell script.
When the downloaded file is a DLL, SystemBC maps it into its own memory space and creates a new thread to execute the entry point meaning that the DLL file does not touch the disk.
Enabling macros on a vulnerable Windows host caused HTTPS traffic to grab a Windows executable (EXE) file for SystemBC malware.
This EXE file was made persistent on the infected host through a scheduled task.
This EXE file was made persistent on the infected host through a scheduled task.
A colleague of mine recently came across a SystemBC sample that is protected with VMProtect 3.6 or higher... The sample is packed twice, so after VMProtect has finished initialization, another layer of packer code runs and unpacks the final SystemBC malware.
update1.exe ... will load, decrypt ... and execute a second executable from an embedded resource, via local PE injection... update2.dll ... also loads a second stage executable payload, via local PE injection.
When the downloaded file is a DLL, SystemBC maps it into its own memory space and creates a new thread to execute the entry point meaning that the DLL file does not touch the disk.
When update4.exe is executed, it will ultimately load, decrypt, and execute shellcode... During execution, update7.exe also utilizes the same custom decryption/decompression loops...
VM Checks Overview of VM checks: cpuid hypervisor bit & hypervisor vendor Trap Flag tricks in combination with forced VM exit via rdtsc/cpuid NtQuerySystemInformation with SystemFirmwareTableInformation, TableIDs FIRM and RSMB
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
The powershell script has a header containing a C2 server and a port number to connect to before then setting up a block of 50 bytes called ‘xordata’...
Enabling macros on a vulnerable Windows host caused HTTPS traffic to grab a Windows executable (EXE) file for SystemBC malware... Next was HTTP traffic to the same IP address over TCP port 80 that returned obfuscated text containing code to start the Cobalt Strike activity.
The first samples of SystemBC... acted primarily as a network proxy, creating what amounted to a virtual private network connection for attackers based on SOCKS5 remote proxy connection encrypted with TLS
The threat actor also used Cobalt Strike SMB beacons to chain beacons together for lateral movement.
It is also linked to the increased use of Tor and other TLS-based network proxies to encapsulate malicious communications between malware and the actors deploying them.
there’s also a significant fraction of TLS communications that use an Internet Protocol port other than 443—such as malware using a Tor or SOCKS proxy over a non-standard port number.
Frequently, droppers and loaders use legitimate websites and cloud services with built-in TLS support to further disguise the traffic.
the majority of TLS traffic we found tied to malware was of the first kind: droppers, loaders and other malware downloading additional malware to the system they infected, using TLS to evade basic payload inspection.
540 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
194 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware family whose communication signatures are recommended for monitoring in relation to The Gentlemen activity.
A SOCKS5 proxy used for covert command-and-control tunneling and persistence in The Gentlemen intrusions.
Windows malware that functions as a SOCKS5 proxy, backdoor, and remote access tool. It tunnels attacker traffic through infected hosts, establishes encrypted C2 communications, executes commands and payloads including EXE, DLL, shellcode, VBS, BAT, CMD, and PowerShell, supports in-memory execution, and maintains persistence via scheduled tasks and Run keys.
Backdoor/proxy malware whose infrastructure was targeted in prior Operation Endgame actions.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.