SystemBC Botnet Hijacked 10,000 Devices Worldwide to Use for DDoS Attacks

The SystemBC malware family, initially identified in 2019, has expanded into a significant botnet infrastructure, currently commandeering over 10,000 devices globally.

Primarily operating as a SOCKS5 proxy and backdoor, this malware facilitates threat actors in concealing malicious activities and sustaining access to compromised networks.

Through transforming infected systems into relays, the botnet enables attackers to route command-and-control communications via victim machines, obscuring their true location and complicating attribution.

This resilient network has persisted despite law enforcement interruptions, such as Europol’s Operation Endgame in May 2024, by shifting its focus to compromising hosting providers rather than residential networks.

The strategic shift allows infections to last longer than typical malware campaigns, with average system compromise lasting 38 days, and some extending beyond 100 days.

The botnet acts as a precursor to ransomware attacks, facilitating data theft and further exploitation. Silent Push analysts have observed a sophisticated tracking system of infected IP addresses globally.

Research has identified the United States as a primary target, with over 4,300 compromised devices, followed by Germany, France, and Singapore. Significant breaches have also been discovered within sensitive government systems in Vietnam and Burkina Faso, often used to launch additional attacks.

A newly discovered SystemBC variant, written in Perl, has been designed to bypass traditional security measures. Files communicating with the botnet’s command infrastructure initially registered zero detections across major antivirus platforms.

This variant is deployed by ELF binary droppers, identified as “SafeObject” and “StringHash,” which use UPX packing to obscure their code from static analysis tools.

Upon unpacking, these droppers search for writable directories before executing numerous embedded payloads. The dropper code, filled with Russian-language strings, potentially indicates the origin of the threat actors.

Given that SystemBC infrastructure often signals the initial stages of an intrusion, security teams are advised to proactively monitor these indicators to thwart potential ransomware escalation.

Based on reporting by Cyber Security News.