SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows

Key Takeaways

  • SystemBC (also tracked as Coroxy) is a Windows malware family that turns infected machines into SOCKS5 proxies.
  • Beyond proxying, SystemBC functions as a persistent backdoor and RAT, executing commands, scripts, and binaries from C2.
  • SystemBC has appeared in intrusions tied to ransomware families including Ryuk, Egregor, Conti, BlackBasta, Play, and Rhysida.
  • Newer builds shift C2 traffic from raw TCP/SOCKS5 toward Tor, using a client resembling the mini-tor library.
  • The Picus Platform simulates SystemBC attacks to test security controls against real-life cyber threats.

What Is SystemBC?

SystemBC (also tracked as Coroxy) is a Windows malware family that primarily turns an infected machine into a SOCKS5 proxy while also functioning as a persistent backdoor and RAT.

Article Link: SystemBC Malware: How the Coroxy Proxy Backdoor Targets Windows